chrome remote desktop curtain mode screenshot

Now, it’s no surprise but the majority of the encoded data is clearly generated from templates and public tools - attackers aren’t re-inventing the wheel every time they need to run shellcode or download another malicious file. Keeping that in mind, I came up with the below regex that gave decent coverage to the possible variants and could easily be applied to a huge corpus of dynamic analysis reports.ĪagBwAGcAIABzAGMAcgBvAGIAagAuAGQAbABsAAoA

There are well over 100,000 variations possible by using combinations of these methods for the “EncodedCommand” parameter alone. Powershell.exe –^e^C^ ZQBjAGgAbwAgACIAVwBpAHQAYwBoACIA Using caret escape-character injection to break-up the string:.Powershell.exe –eNco ZQBjAGgAbwAgACIAVwBpAHoAYQByAGQAIgA= Truncated with alternate capitalization:.

Powershell.exe –EncodedCommand ZQBjAGgAbwAgACIARABvAHIAbwB0AGgAeQAiAA= Because PowerShell gives you a lot of flexibility when it comes to calling different parameters, identifying samples isn’t as straightforward as one might expect.īelow are three examples of different ways the EncodedCommand parameter can be called: To perform this analysis, I needed to first identify samples that were using this technique. Second, I will be using this blog to catalog the PowerShell code with examples of each decoded sample to aide in future identification or research. First, in the “Analysis Overview”, I will be analyzing 4,100 recent samples identified within Palo Alto Networks AutoFocus that employ this EncodedCommand technique to see how PowerShell is being used and what techniques are being used in the wild for PowerShell attacks.

The purpose of this blog will be two-fold. By masking the “malicious” part of your command from prying eyes you can avoid strings that may tip-off the defense. As shown above from the PowerShell Help output, it’s a command intended to take complex strings that may otherwise cause issues for the command-line and wrap them up for PowerShell to execute.

Chrome remote desktop curtain mode screenshot