Please use this identifier to cite or link to this item:
https://www.um.edu.mt/library/oar/handle/123456789/65405
Full metadata record
DC Field | Value | Language |
---|---|---|
dc.date.accessioned | 2020-12-09T10:54:07Z | - |
dc.date.available | 2020-12-09T10:54:07Z | - |
dc.date.issued | 2019 | - |
dc.identifier.citation | Sciberras, N. (2019). Responding to PowerShell attacks (Bachelor's dissertation). | en_GB |
dc.identifier.uri | https://www.um.edu.mt/library/oar/handle/123456789/65405 | - |
dc.description | B.SC.(HONS)COMP.SCI. | en_GB |
dc.description.abstract | PowerShell has become such a ubiquitous tool, it is found in all Windows environments spanning from personal computers to large corporate networks. It offers an interactive, object oriented shell ported to the .NET Framework which makes it different from other text-based shells. It facilitates the administration of very large corporate networks, allowing administrators to issue commands remotely on other computers seamlessly. Complemented with Windows Management Instrumentation (WMI), PowerShell is an even greater asset; it gives access to every imaginable resource on a device and across the network. Having become such an established tool, it is installed by default on all modern operating systems. Just as PowerShell gained its popularity, fileless malware has become a trend in modern day cyber attacks. Unlike traditional malware which requires that malicious programs are installed on the target machine prior to execution, fileless malware often exploits already installed tools. Furthermore, payloads are directly loaded and directly executed into memory and never touch disk. Hence the only evidence lives for a very short time in memory. This project focuses on investigating WMI attacks through PowerShell in an incident response scenario. PowerShell and WMI being both whitelisted by conventional antimalware tools, and also promoting stealth, have become an attacker’s favourite. PSInvestigate, the designed memory forensics solution, is based on the study of the underlying Component Object Model (COM) objects produced by the WMI activity. It provides an acquisition solution which dumps a sample of PowerShell’s memory containing the studied artifacts. The dumping is narrowed by first locating the sections in memory where the said objects reside, and then using two specific trigger points to invoke the dumping procedure. This also helps in keeping the dump size as small as possible. The analysis stage then makes use of an observed pattern to extract the useful information. The results returned by PS-Investigate are comparable to the results obtained by the Event Tracing for Windows (ETW). PS-Investigate though enjoys a reduced Trusted Computing Base (TCB), making it more secure and reliable. Although some overhead is introduced, its results provided a good level of information, even when compared to ETW. | en_GB |
dc.language.iso | en | en_GB |
dc.rights | info:eu-repo/semantics/restrictedAccess | en_GB |
dc.subject | Windows PowerShell (Computer program language) | en_GB |
dc.subject | Systems software | en_GB |
dc.subject | Microsoft Windows (Computer file) | en_GB |
dc.subject | Operating systems (Computers) | en_GB |
dc.subject | Malware (Computer software) | en_GB |
dc.title | Responding to PowerShell attacks | en_GB |
dc.type | bachelorThesis | en_GB |
dc.rights.holder | The copyright of this work belongs to the author(s)/publisher. The rights of this work are as defined by the appropriate Copyright Legislation or as modified by any successive legislation. Users may access this work and can make use of the information contained in accordance with the Copyright Legislation provided that the author must be properly acknowledged. Further distribution or reproduction in any format is prohibited without the prior permission of the copyright holder. | en_GB |
dc.publisher.institution | University of Malta | en_GB |
dc.publisher.department | Faculty of Information and Communication Technology. Department of Computer Science | en_GB |
dc.description.reviewed | N/A | en_GB |
dc.contributor.creator | Sciberras, Neil | - |
Appears in Collections: | Dissertations - FacICT - 2019 Dissertations - FacICTCS - 2019 |
Files in This Item:
File | Description | Size | Format | |
---|---|---|---|---|
19BCS006 - Sciberras Neil.pdf Restricted Access | 1.6 MB | Adobe PDF | View/Open Request a copy |
Items in OAR@UM are protected by copyright, with all rights reserved, unless otherwise indicated.