Using PowerShell for triage
The most important aspect of responding to a malware incident is triage. During this step of the process, we ascertain the impact the malware running on our hosts has had, and answer a few questions:
- What files were written to the system?
- What persistence mechanisms exist, if any?
- What was the initial vector responsible for infection?
- What are the roles of the artifacts we've identified as a result of answering the other questions?
Triage can be a time-consuming process, and if multiple incidents exist within the same timeframe, it may be difficult to adequately assess each incident in a timely manner – and time is often of the essence in a security incident.
Thankfully, PowerShell is here to help, and is installed out of the box on all Windows environments since Windows 7. Because of the ubiquity of this powerful scripting engine (and the ubiquity of Windows malware), it makes an obvious choice for scripting initial...
