How Hackers Can Hide PowerShell in Environment Variables
Source: YouTube · John Hammond · published Apr 5, 2024 · 25:28
This video demonstrates how to obfuscate PowerShell code by using characters from Windows environment variables 0:00. The presenter creates a proof-of-concept tool that maps which characters are available in static environment variables and uses them to hide malicious commands 1:16.
Key Takeaways:
• Environment variables in Windows PowerShell can be accessed as a drive and listed using Get-ChildItem 0:39
• Static environment variables (like CommonProgramFiles or ComSpec) that rarely change are ideal for this obfuscation technique 1:00
• The presenter builds a Python script to map characters available in environment variables and their positions 5:59
• The obfuscation technique randomly selects environment variables containing needed characters and references them by index in PowerShell 11:00
• The technique successfully creates functional obfuscated PowerShell commands that can evade simple detection 24:58
This method demonstrates how attackers could hide malicious PowerShell code by making it appear as innocent references to system environment variables 17:00.
Sources:
- 0:00 Introduction to environment variable obfuscation concept
- 0:39 Explanation of environment variables as PowerShell drives
- 1:00 Identifying static environment variables
- 5:59 Building character mapping script
- [11:00](https://www.youtube.com/watch?v=8CiNx4n
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello it's me again and today we're going to do something weird you know how on your computer whether or not you're in Linux or Windows you have these environment variables different settings different switches different things you could configure or tweak for your environment things like the path variable commands and applications programs you can run from the command line but on Windows in Powershell it's a little bit interesting because they're actually even also configured as a Powershell drive so if I were to dir like old school cmd.exe command prompt rendition or LS maybe an alias inside of Powershell and of course the commandlet get child item ultimately we could go interrogate and ask for things that are in our EnV or environment drive and this will list out all of the specific env…