Investigating Subversive PowerShell Profiles


https://web.archive.org/web/20151116221721/https://www.exploit-monday.com/2015/11/investigating-subversive-powershell.html



OLD but GOLD 😁


#powershell , #old_but_gold

decoded PowerShell script that perform C2 connection. The script decodes and executes commands received from a C2 server by using R64Decoder Function.
credit : @whichbuffer


this tool was used by an APT to target @bellingcat

https://gist.github.com/whichbuffer/22621545f9f5a1d946affd34f6659e64

#c2 , #powershell , #tool

PSRansom: a PowerShell Ransomware Simulator with C2 Server capabilities.

https://github.com/JoelGMSec/PSRansom

#c2 , #powershell , #simulat , #tool
———
@islemolecule_source

"PowerShell Automation and Scripting for Cybersecurity: Hacking and defense for red and blue teamers", 2023.

#powershell
———
@islemolecule_source