Investigating post-exploitation frameworks

The primary post-exploitation framework that analysts will encounter is Cobalt Strike. There are other frameworks such as PowerSploit or Meterpreter that are commonly available and can be used by even the most novice threat actor. One primary mechanism that these exploitation frameworks utilize is encoded PowerShell scripts to establish a reverse connection back to the threat actor’s command and control infrastructure.

There are a few benefits to this approach from an adversary’s perspective. First, the scripts can be loaded in a variety of places to survive a reboot. For example, MITRE ATT&CK technique Scheduled Task/Job: Scheduled Task [T1053.005] involves using the Windows OS Scheduled Task feature to execute the script at a predetermined time. Additionally, malicious scripts can be placed within the registry, such as in the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key.

The second benefit is that...