Reverse Engineering and Malware Analysis
Reverse Engineering and Malware Analysis
Sign in to save your progress, earn points, and unlock module exams.
Topic 5.3 of In-Depth Malware Analysis
Six PowerShell obfuscation techniques with decode procedures, AMSI interception and bypass, Script Block Logging for automatic cleartext capture, de-obfuscation tools, and a four-step workflow.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
EZ Bytes · quick recaps
AMSI Got Patched. Event ID 4104 Still Caught It. | Obfuscated PowerShell Analysis
85s
Video lessons
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
Downloadable reference material
External links
Quadrant 4 · Self-Assessment
In-Depth Malware Analysis
Covers packed malware, manual unpacking, obfuscated PowerShell, fileless malware, code injection, API hooking, memory forensics with Volatility, sandbox analysis, and network signatures.
REMA: Complete Assessment
A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.
Quadrant 5 · Play
Ungraded practice for Obfuscated PowerShell Scripts: games and hands-on Skill Labs that use this topic, plus the crossword for In-Depth Malware Analysis. It never affects your unit assessment, and clearing a game or lab for the first time earns EZ Board points when you are signed in.
Crossword
In-Depth Malware Analysis
9 key terms from this unit. Free to play.
Spot
Spot the IOC
8 items from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Race
Unpack Underpass
6 checkpoints from this unit. Free to play. Earn 30 EZ Board points on your first clear.
3D Case
The Midnight Lockout
8 clues from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Discussion · 0 comments
This is the discussion thread for the lesson "Obfuscated PowerShell Scripts" (Reverse Engineering and Malware Analysis, Unit 5). Ask questions, share real-world examples, and help classmates who are stuck. Conversation starters. Try explaining one of these in your own words: - Decode a UTF-16LE Base64 encoded PowerShell command on both Linux and Windows - Identify six PowerShell obfuscation techniques from command-line examples - Explain where in the execution pipeline AMSI intercepts script content
No comments yet. Start the conversation. Comments here also appear in the forum.
Open in forumMITRE ATT&CK — Command and Scripting Interpreter: PowerShell (T1059.001)
ATT&CK technique for PowerShell abuse with obfuscation examples, detection guidance, and real-world procedure references.