.NET Process Injection – Tim MalcomVetter – Medium

（情報元のブックマーク数 ）

メモ

For a while now, I have been saying that PowerShell is dead in high security environments. Yes, it still works in environments where they haven’t figured out how to monitor PowerShell or at least process creation commands and arguments, but as soon as a defensive team implements visibility into this space, defense (the blue team) has all the advantages over an adversary playing in this space.

.NET Process Injection – Tim MalcomVetter – Medium