Revoke-Obfuscation

Revoke-Obfuscation v1.0 はじめに Revoke-Obfuscationは、PowerShell v3.0以上に対応したPowerShell難読化検出フレームワークです。 著者 Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes 研究 ブログ記事：https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html...

Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework. Authors Daniel Bohannon @danielhbohannon Lee Holmes @LeeHomes Research Blog Post: https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html White Paper:...

PowerShell Obfuscation Detection Framework: Revoke-Obfuscation

Revoke-Obfuscation is an open-source PowerShell v3.0+ framework for detecting obfuscated PowerShell commands and scripts at scale. It relies on PowerShell’s AST Abstract Syntax Tree to rapidly extract thousands of features from any input PowerShell script and compare this feature vector against o...