POSHSPY

Fileless WMI and PowerShell Backdoors (POSHSPY)

APT29 POSHSPY backdoor sample (redacted) forked from: https://github.com/matthewdunwoody/POSHSPY/

References

• https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
• https://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
• https://www.youtube.com/watch?v=Ldzr0bfGtHc