Lion Cipher Lab

Catch a fileless attack with the ETW telemetry Sysmon can't see

• SOC Analyst / Blue Team
• Advanced
• ~90 min
• Free · no account required

Why it matters

The most effective intrusions of the last decade stopped writing malware to disk. They run their code in memory — a PowerShell one-liner, a .NET assembly loaded reflectively, a script pulled straight into RAM — so that the two controls most defenders lean on see nothing. A file-based antivirus scan has no file to scan. Sysmon's process-creation event faithfully records the command line, but the attacker scrambles that command line into meaningless characters that reassemble themselves only once they are already running in memory, so the one artifact Sysmon captured is useless. This is…

What you'll learn

• what Event Tracing for Windows (ETW) is, and why it is a richer telemetry source than Sysmon or a file-based AV scan for in-memory / fileless activity
• enabling PowerShell script-block logging and reading Event ID 4104 — the log that shows the DEOBFUSCATED script even when the command line was scrambled to hide it
• proving the detection gap first-hand: an obfuscated in-memory one-liner whose process command line is meaningless, whose script-block log is fully readable
• subscribing to ETW providers that never reach the Windows Event Log — AMSI (antimalware scan), the .NET CLR, PowerShell — with a standalone consumer (Sealighter or SilkETW)
• authoring a detection from the captured events and TUNING it to survive the volume of benign PowerShell and .NET activity a real host generates
• the named failure modes: a provider that needs admin or isn't emitting, event-volume flood dropping your signal, benign-admin-PowerShell false positives
• the two honest blind spots — the AMSI provider only sees content that actually reaches AMSI (a true AmsiScanBuffer patch shows NOTHING), and a privileged attacker can blind ETW itself
• the judgment: ETW/script-block telemetry is one correlated layer beside EDR and Sysmon, not a silver bullet — and why a determined adversary treats your telemetry as a target

Steps in this lab

1. The gap: why disk-scans and command lines miss fileless code
2. What ETW is, in plain terms
3. Turn on PowerShell Script Block Logging (it is OFF by default)
4. Fire a benign, obfuscated, in-memory one-liner
5. Read Event ID 4104 — the deobfuscated script the engine actually ran
6. Reach the providers the Event Log never shows — set up a consumer
7. About AMSI — and why its test string stays at Microsoft's docs
8. Author a detection and tune it against real volume
9. The honest limits: AMSI blind spots and ETW blinding
10. Why this matters, and where it fits (opinion)

Open the full interactive lab →