Invoke-Phant0m detecting

[Hesp1]

How Can I detect this attack and prevent it?

[cybervaca]

You can restrict the type of powershell language for this type of attacks to be ineffective.

https://itfordummies.net/2015/06/01/powershell-constrained-mode/

Regards.

[Hesp1]

And how Can I detect it?
Not preventing!

[cybervaca]

I wrote the script author about your question. As soon as we know something we tell you.

[cybervaca]

Here is what he told me:

Hi,

Thank you for your interest.

Basically, you need to watch endpoint system for detecting attacks like Invoke-Phant0m. I would recommend you to check this resources;

https://securitylogsdotorg.files.wordpress.com/2017/06/bsides-athens-sysmon-final.pdf
https://twitter.com/inslainity/status/867172350457925632

Regards.