PowerShell is the favorit tool of IT guys, who are responsible for administration of Windows infrastructures. It allows them to manage differen services of the operating system and automate almost anything. But along with administrators, PowerShell also is liked by attackers and malware authors. The reason PowerShell is so attractive for adversaries is quite obvious: it has been included in essentially every Windows operating system by default for a decade, provides access to Windows API, and is rarely constrained, thus allowing adversaries to perform different tasks without risking being blocked. ttackers can use PowerShell to direct the execution of a local script, retrieve and execute remote resources using various network protocols, encode payloads passed via the command line, or load PowerShell into other processes.

Because of so prevalence of PowerShell among adversaries for Threat Hunters it is very important to be able to detect malicious uses of PowerShell and defend against it. In the presentation…

00:58 - Installing FireEye Commando to help keep our development environments sync'd
04:30 - Using Git to download mimikatz, openifang with Visual Studio 2017 and installing dependencies
08:50 - Verifying that we can compile mimikatz before we make any changes.
11:15 - Creating an Antivirus Exception in Defender to ignore shared drive
12:30 - Remove String: mimikatz and then rename files with mimikatz in the name
13:45 - Remove String: all metadata by editing the RC File (accidentally wipe a quote)
15:00 - Replace Icon
16:00 - Test rebuilding after these changes.
18:00 - Using "head" to split the binary in half to help identify where Defender is identifying mimikatz
19:00 - Tons of splitting.
21:20 - Found a rough location of a bad string, opening in a hex editor to identify the string.
22:30 - Appears to flag on KiwiAndRegistryTools, lets verify
24:10 - Search and replace for "mimi" (whoops, should of done kiwi here!)
25:50 - Remove String: KiwiAndRegistryTools
27:20 - Decompressing the Defender Signature File…