PowerShell Protect: Auditing and blocking suspicious behavior in PowerShell
PowerShell Protect is a new product by Ironman Software that features an antimalware scan interface provider to detect suspicious activity. It can be used to audit and block the behavior.
In this video, we dive into module and script block logging, AMSI, bypassing both feature and then use PowerShell Protect to harden the system to help prevent common suspicious scripts that may be signs of an exploit.
To learn all about the feature of PowerShell Protect in this video, visit our blog: https://blog.ironmansoftware.com/prot...
To learn about module and script block logging, visit the BC Security blog: https://www.bc-security.org/post/powe...
To learn about AMSI bypasses, visit the Context Information Security Blog: https://www.contextis.com/en/blog/ams...