Further reading
If you want to explore some of the topics that were mentioned in this chapter, follow these resources:
- Blue Team Notes: https://github.com/Purp1eW0lf/Blue-Team-Notes
- Blue Team Tips: https://sneakymonkey.net/blue-team-tips/
- A collection of PowerShell functions and scripts a blue teamer might use: https://github.com/tobor88/PowerShell-Blue-Team
- Creating and Starting a Windows Service Remotely Using NtObjectManager Via Remote Procedure Calls (RPC) Over SMB: https://blog.openthreatresearch.com/ntobjectmanager_rpc_smb_scm
- Detecting and Preventing PowerShell Downgrade Attacks: https://www.leeholmes.com/detecting-and-preventing-powershell-downgrade-attacks/
- Directory Services Internals Blog: https://www.dsinternals.com/en/
- Investigating PowerShell Attacks: https://www.fireeye.com/content/dam/fireeye-www/global/en/solutions/pdfs/wp-lazanciyan-investigating-powershell-attacks.pdf
- PowerForensics - PowerShell Digital Forensics: https://powerforensics...
