Switch branches/tags
Nothing to show
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
..
Failed to load latest commit information.
README.md
ps_encodedcommand_data.txt
ps_encodedcommand_data.zip
psfamid.py

README.md

Underlying data for following blog:

http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

UPDATE 20NOV2017

Added "psfamid.py" which is a small script where I converted the original regex queries/logic for family identification/matching into something that could be run adhoc. Either supply a file or base64 encoded string and it will attempt to match certain indicators to known families.

This script is not maintained but just provided for additional insight if interested.