Suspicious PowerShell Analysis

🧪 Lab Description

This advanced DFIR lab gives you a real obfuscated PowerShell sample (safely defanged) recovered from a compromised endpoint. You'll use static and dynamic analysis techniques to decode the payload, map the attack to MITRE ATT&CK, extract network IOCs, and create both Splunk detection rules and YARA signatures.

The sample uses multiple layers of obfuscation including Base64 encoding, string concatenation, and reflection — techniques commonly used by commodity malware and APT actors.

🎯 Learning Objectives

• Identify PowerShell obfuscation techniques (Base64, concatenation, reflection)
• Use CyberChef to decode multi-layer obfuscated scripts
• Perform safe dynamic analysis using FLARE VM sandbox
• Extract network IOCs: C2 domains, IP addresses, user-agents
• Map PowerShell TTPs to MITRE ATT&CK (T1059.001, T1027, T1105)
• Write a Splunk PowerShell detection rule (Script Block Logging)
• Create a basic YARA rule for the decoded payload

📋 Prerequisites

• Completion of RDP Brute Force Detection lab
• Basic PowerShell knowledge (not required but helpful)
• Familiarity with Base64 encoding concepts
• VirtualBox with 16GB RAM available (FLARE VM is resource-heavy)
• Understanding of MITRE ATT&CK framework

📝 The Sample (Defanged)

The following is the obfuscated PowerShell command recovered from endpoint memory:

Your first task: decode this and identify what it's doing before running any further analysis.