Let’s talk

Growing MSSP with Offensive Services

Sample behaviour and endpoint activity

Unpack a staged PowerShell malware chain

I checked the client endpoint for the behaviours seen during controlled execution. The records did not show corresponding MSBuild activity, C2 communication or Autorun persistence after CrowdStrike interrupted execution. The resulting report explained the staged loader and its detection-relevant behaviour without treating laboratory execution as proof that the client experienced every stage.

PowerShellStatic analysisDynamic analysisProcmonMSBuildWindows API analysisRegistry persistenceCrowdStrike
Return to the full story ←

Your exploration

Viewed history

Saved only in this browser.

Ask my portfolio

Ask about my work.

Skills, achievements, technical detail. Follow the evidence.

Every answer links to the work.
How this works

When AI is connected, your question, recent questions and relevant published pages are sent to MiniMax to select supporting passages. Otherwise, this searches the site directly. Answers quote the saved website and link to their sources. This website does not save chat transcripts. Clearing or leaving the page clears this conversation.