06 - Lab 6.How to test protection against fileless threats
Scenario. Recently, a new threat vector has become popular, which uses PowerShell, a powerful operating system
administration and management tool. Criminals can run their code in the address space of the PowerShell process. A fileless
attack is hard to detect since malicious code is executed in the memory, unlike an ordinary virus that stores its files on the local
drive. Typically, attacks via PowerShell are performed after the machine has been compromised using other malicious actions,
usually, exploitation of software vulnerabilities.
Contents. In this lab, we will disable KSN and test how antimalware scan interface (AMSI) detects fileless threats.