The best way to improve your #PowerShell skills is to DO. That's why I wrote The PowerShell Practice Primer. No lab setup needed. 100+ exercises, including PowerShell 7 content. https://leanpub.com/psprimer
PowerShell Weekly for May 16, 2025 is out now with Announcements, Community highlights, Fun sections, and more. Check it out!
#PowerShell #Automation #TechNews
https://psweekly.dowst.dev/?p=7851
Hackers Leveraging PowerShell to Bypass Antivirus and EDR Defenses https://gbhackers.com/hackers-leveraging-powershell/ #CyberSecurityNews #cybersecurity #PowerShell #Microsoft
Had occasion to use:
<code>-ErrorVariable +ev -ErrorAction SilentlyContinue</code>
in order to handle/log non-fatal errors within a #powershell pipeline. I want to know the parameter in question on caught errors. The thrown cmdlet exception didn't provide it.
Can't see any advantage (the docs are... anemic) to InvocationInfo.PipelinePosition or PipelineIterationInfo (directly on the ErrorRecord) to pull by index (-1) from the root collection.
Fileless Remcos RAT Attack Evades Antivirus Using PowerShell Scripts https://hackread.com/fileless-remcos-rat-attack-antivirus-powershell-scripts/ #Cybersecurity #CyberAttack #PowerShell #RemcosRAT #Security #Malware #TROJAN
Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT
A new PowerShell-based shellcode loader has been discovered, designed to execute a variant of Remcos RAT. The attack chain begins with malicious LNK files in ZIP archives, using mshta.exe for initial execution. The loader employs fileless techniques, executing code directly in memory to evade traditional defenses. It leverages Windows APIs to allocate memory and execute binary code. The Remcos RAT provides full system control, featuring keylogging, screen capture, and credential theft capabilities. It uses advanced evasion techniques like process hollowing and UAC bypass. The malware establishes persistence through registry modifications and connects to a command and control server over TLS. This sophisticated attack emphasizes the need for behavioral analytics and proactive security measures to detect and mitigate such stealthy threats.
Pulse ID: 68264a9c6f5993a7d13fcfbc
Pulse Link: https://otx.alienvault.com/pulse/68264a9c6f5993a7d13fcfbc
Pulse Author: AlienVault
Created: 2025-05-15 20:12:12
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Excel(ent) Obfuscation: Regex Gone Rogue
A new Excel-based attack technique leverages recently introduced regex functions for advanced code obfuscation. The proof-of-concept demonstrates how malicious actors can use REGEXEXTRACT to hide PowerShell commands within large text blocks, significantly reducing antivirus detection rates. This method outperforms traditional obfuscation techniques, dropping VirusTotal detections from 22 to just 2. The approach also evades heuristic analysis tools like OLEVBA. While currently limited by Microsoft's default macro security and the functions' limited availability, this technique could potentially be combined with more sophisticated attack methods as it becomes more widely accessible.
Pulse ID: 6825f54fef573f818bd2d43c
Pulse Link: https://otx.alienvault.com/pulse/6825f54fef573f818bd2d43c
Pulse Author: AlienVault
Created: 2025-05-15 14:08:15
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Shorten #Azure CLI commands in #PowerShell without backticks https://mikefrobbins.com/2025/05/15/shorten-azure-cli-commands-in-powershell-without-backticks/
Microsoft Graph PowerShell SDK V2.28 Attempts to Restore Stability
On May 10, 2025, Microsoft released V2.28 of the Microsoft Graph PowerShell SDK in the hope that the new version would fix a bunch of annoying problems that have dogged the SDK for several months. The first few days haven’t revealed any new problems and bug reports are being closed, so the signs are positive. But do test before deploying V2.28 into production.
https://office365itpros.com/2025/05/15/microsoft-graph-powershell-sdk-228/
#PowerShell #MicrosoftGraph #Microsoft365
Windows Update Group Policy in 2025: Complete Configuration Guide | https://techygeekshome.info/windows-update-group-policy-2025/?fsp_sid=22392 | #2025Tech #GroupPolicy #InTune #Powershell #Windows11 #WindowsUpdate
https://techygeekshome.info/windows-update-group-policy-2025/?fsp_sid=22392
@denelon.bsky.social will be on stage for #PSConfEU 2025 in #Malmö (23-26 June)!
Whats new in WinGet
Tickets and full schedule available at psconf.eu
#PowerShell #Skåne #Svenska #Sweden #IT #automation #WinGet
New 'Chihuahua Stealer' Targets Browser Data and Crypto Wallets
A novel infostealer named Chihuahua Stealer has been detected, blending standard malware techniques with advanced features. This .NET-based malware employs a multi-stage PowerShell script infection process, utilizing Base64 encoding, hex-string obfuscation, and scheduled tasks for persistence. It targets browser data and cryptocurrency wallet extensions, extracting credentials, cookies, autofill data, browsing history, and payment information. The stolen data is compressed, encrypted using AES-GCM, and exfiltrated to an external server. The malware's sophisticated execution chain includes stealthy loading and a multi-staged payload, making it challenging to detect and analyze.
Pulse ID: 6824a0fe7bd740a9edd5ae96
Pulse Link: https://otx.alienvault.com/pulse/6824a0fe7bd740a9edd5ae96
Pulse Author: AlienVault
Created: 2025-05-14 13:56:14
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
TA406 Pivots to the Front
In February 2025, TA406, a North Korean state-sponsored actor, began targeting Ukrainian government entities with phishing campaigns aimed at gathering intelligence on the Russian invasion. The group utilized freemail senders impersonating think tank members to deliver both credential harvesting attempts and malware. Their tactics included using HTML and CHM files with embedded PowerShell for malware deployment, as well as fake Microsoft security alerts for credential theft. The malware conducted extensive reconnaissance on target hosts, gathering system information and checking for anti-virus tools. TA406's focus appears to be on collecting strategic, political intelligence to assess the ongoing conflict and potential risks to North Korean forces in the region.
Pulse ID: 6823b32f1fad0a568539c4c1
Pulse Link: https://otx.alienvault.com/pulse/6823b32f1fad0a568539c4c1
Pulse Author: AlienVault
Created: 2025-05-13 21:01:35
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
