There is no doubt that security has been in the spotlight over the last few years, recent events have been responsible for the increased demand for better and more secure systems. Security was often treated as an afterthought or something that could be implemented ‘later’. In this session, we will go over some best practices, using existing tools and frameworks to help you set up a more secure environment and to get a grasp of what is happening in your environment. We will leverage your existing automation skills to secure and automate these workflows. Expect a session with a lot of demos and resources that can directly be implemented.

1. Automating Security
with PowerShell
Jaap Brasser
@jaap_brasser

2. @Jaap_Brasser
jaapbrasser.com/about

3. Agenda
PowerShell & .Demo
Defensive
Offensive
& .Demo Q & A

4. Agenda
State of PowerShell

5. Agenda
• Differences between editors
• Configure VSCode
• Working with Vscode
• Setting up the ISE
• Working with the ISE and ISESteroids
• Questions
Demo
Mimikatz &
PowerShell Logging

6. Demo
Summary
• Setup PowerShell logging
• Dump credentials
• Reconfigure logging
• Follow bread crumbs
• Determined what ran

7. Agenda
Offensive PowerShell

8. Agenda
• Differences between editors
• Configure VSCode
• Working with Vscode
• Setting up the ISE
• Working with the ISE and ISESteroids
• Questions
Demo
Obfuscation &
Detection

9. Demo
Summary
• Determined character frequency
• Used Vector Frequency
• Encoded existing scripts
• Looked at different methods of obfuscation

10. Agenda
Defensive PowerShell

11. Questions

12. References
• github.com/jaapbrasser/Events/tree/master/BSidesAms2017
• www.bsidesams.nl
• jaapbrasser.com