WEBVTT

00:00:01.400 --> 00:00:03.220
Awesome! I hope you really enjoyed these demos.

00:00:03.420 --> 00:00:06.170
If you like the PowerSploit framework, I have good news for you.

00:00:06.640 --> 00:00:09.000
There're tons of attacks that can be performed in this too.

00:00:09.610 --> 00:00:12.390
For example, you can use PowerSploit for reconnaissance,

00:00:12.510 --> 00:00:15.150
such as identifying users and computers in the domain.

00:00:16.300 --> 00:00:19.240
And also you can use PowerSploit for code execution,

00:00:19.400 --> 00:00:22.530
meaning that PowerSploit helps you to inject malicious code into

00:00:22.530 --> 00:00:26.710
current processes and also some other code execution techniques.

00:00:26.710 --> 00:00:30.650
PowerSploit can also be used for privilege escalation since it

00:00:30.650 --> 00:00:33.840
contains a lot of scripts that help you to identify misconfigurations

00:00:34.040 --> 00:00:38.140
that can lead to privilege escalation. And also PowerSploit has a

00:00:38.140 --> 00:00:39.870
whole module about persistence.

00:00:40.200 --> 00:00:40.830
For example,

00:00:40.890 --> 00:00:45.250
you can use PowerSploit to set up hidden services or hidden scheduled tasks.

00:00:46.140 --> 00:00:50.460
And believe it or not, PowerSploit also has a model for antivirus bypass,

00:00:50.600 --> 00:00:54.490
which contains code obfuscation scripts. And last but also really

00:00:54.490 --> 00:00:57.910
important, PowerSploit has a few tools for data exfiltration,

00:00:58.110 --> 00:01:01.080
which will help us to encrypt the data and send it outside of the

00:01:01.080 --> 00:01:04.680
network in ways to blend with normal traffic. Pretty cool,

00:01:04.680 --> 00:01:08.530
right? Just to have an idea, PowerSploit covers a total of 23

00:01:08.530 --> 00:01:10.850
tactics from the Mitre Att&ck framework.

00:01:12.640 --> 00:01:13.620
So before we go,

00:01:13.630 --> 00:01:16.750
I want to leave you with more information about this really interesting tool.

00:01:17.480 --> 00:01:17.970
First,

00:01:18.080 --> 00:01:21.070
the official documentation. In the PowerSploit GitHub, you

00:01:21.070 --> 00:01:24.010
can find details about several of the modules and even some

00:01:24.010 --> 00:01:25.850
examples of how to run the tags.

00:01:26.690 --> 00:01:30.220
But if you want to get really good at PowerSploit, I can recommend you a

00:01:30.220 --> 00:01:33.950
really good course here at Pluralsight. It's called Getting Started with

00:01:33.950 --> 00:01:38.510
PowerSploit. This course is over two hours long and covers the main attacks

00:01:38.510 --> 00:01:41.760
that we can perform with PowerSploit. Also,

00:01:41.800 --> 00:01:44.250
if you're interested in antivirus invasion, you can check

00:01:44.250 --> 00:01:46.580
out another course here at Pluralsight called Defense

00:01:46.580 --> 00:01:48.750
Evasion with Invoke‑Obfuscation.

00:01:49.340 --> 00:01:49.820
In there,

00:01:49.860 --> 00:01:52.240
you learn how to bypass the majority of the traditional

00:01:52.250 --> 00:01:54.850
antivirus solutions with an invoke‑obfuscation tool.

00:01:56.010 --> 00:01:58.530
And if you're wondering how to prevent your company from

00:01:58.530 --> 00:02:00.570
being exploited by the PowerSploit framework,

00:02:00.650 --> 00:02:01.950
I have two suggestions.

00:02:03.040 --> 00:02:04.570
First, as you may have noticed,

00:02:04.650 --> 00:02:08.150
using traditional signature‑based antivirus solutions may not be enough.

00:02:08.539 --> 00:02:10.960
So I do recommend you using detection tools in each

00:02:10.960 --> 00:02:13.650
machine that detect abnormal user behavior.

00:02:14.540 --> 00:02:18.530
And in addition to that, network detection tools that look for abnormal

00:02:18.530 --> 00:02:22.880
behavior in network traffic. And the keyword here is behavior instead of

00:02:22.890 --> 00:02:25.740
looking for just malware signatures. For example,

00:02:25.830 --> 00:02:28.380
if you see a user trying to access dozens of network

00:02:28.380 --> 00:02:31.950
file shares in less than 10 seconds, then it is something to be alerted.

00:02:33.740 --> 00:02:36.750
So that's it. This is the end of our Collection with PowerSploit course.

00:02:37.190 --> 00:02:39.150
Thank you for watching, and I'll see you soon.