Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Pulling Back the Curtains on Encoded Command Power Shell Attacks

Summary: Unit 42 analyzed 4,100 recent AutoFocus samples using PowerShell's -EncodedCommand parameter, which passes a base64-encoded string to PowerShell for execution. Over half of the samples used either a generic DownloadFile-StartProcess technique or a shellcode injection variant, and 1,159 of the DOC files matched known Cerber ransomware patterns.

What you should know: The EncodedCommand parameter has well over 100,000 possible variations, and the code is largely copied from public tools like SET and Magic Unicorn, so signature-based detection of the command line alone will miss most of it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related