Investigating PowerShell attacks
In the previous sections, you learned about the PowerShell and Windows event logs that help you investigate suspicious executions with PowerShell. During this section, we will introduce an example of PowerShell attacks and examples of suspicious PowerShell commands and cmdlets, along with their description and purpose, to help you investigate and observe suspicious PowerShell executions.
Fileless PowerShell malware
Fileless malware, also known as memory-based malware, refers to a type of malicious code that runs directly in memory without leaving traces of traditional executable files on the system disk.
An attacker may use a PowerShell cradle to download a malicious PowerShell script and execute it directly in memory to evade writing to the disk and evade being detected by defense mechanisms. The following is an example of a common PowerShell cradle that uses the DownloadString function to download a malicious script from a remote server to...
