[SANS ISC] Example of Malicious DLL Injected in PowerShell

I published the following diary on isc.sans.edu: “Example of Malicious DLL Injected in PowerShell“:

For a while, PowerShell remains one of the favorite languages for attackers. Installed by default (and almost impossible to get rid of it), powerful, perfectly integrated with the core operating system. It’s very easy to develop specific PowerShell functions that will provide interesting features for an attacker but, if written in PowerShell, they could easily ring a bell for the defenders (example: by using many suspicious API calls). Another technique to expand the language with more functions is just to load a DLL! I found a sample that exfiltrates data from the victim’s computer… [Read more]