Powershell-Fu - Hunting on the Endpoint

Explore advanced endpoint hunting techniques using PowerShell in this 28-minute conference talk from BSidesLV 2016. Delve into the world of threat hunting as Chris Gerritz breaks down the differences between hunting and DFIR, introduces essential tools for hunters, and presents two distinct hunting methodologies. Learn about PSHunt components and modules, including scanners, survey deployment, and execution methods. Discover techniques for testing access, analyzing persistence mechanisms, and detecting memory-resident malware. Gain insights into survey analysis modules, process memory injection, and the initialization of reputation data. Master the art of PowerShell-based threat hunting to enhance your cybersecurity skills and protect endpoints effectively.