“obfuscation-detection”的搜索结果

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

中文简介正在准备中。当前显示原文说明。

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

中文简介正在准备中。当前显示原文说明。