add POSHSPY

RamadhanAmizudin · Jun 13, 2017 · c7ac848 · c7ac848
1 parent 990898f
commit c7ac848
Show file tree

Hide file tree

Showing 3 changed files with 939 additions and 0 deletions.
diff --git a/POSHSPY/README.md b/POSHSPY/README.md
@@ -0,0 +1,10 @@
+# POSHSPY
+Fileless WMI and PowerShell Backdoors (POSHSPY)
+
+APT29 POSHSPY backdoor sample (redacted) forked from: https://github.com/matthewdunwoody/POSHSPY/
+
+### References
+
+* https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
+* https://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
+* https://www.youtube.com/watch?v=Ldzr0bfGtHc