Investigating Powershell Attacks

Over the past two years, the presenters have seen targeted attackers increasingly make use of PowerShell to conduct command-and-control in compromised Windows environments. If the user's organization is running Windows 7 or Server 2008 R2, they've got PowerShell 2.0 installed (and on Server 2012, remoting is enabled by default!).