# POSHSPY
Fileless WMI and PowerShell Backdoors (POSHSPY)

APT29 POSHSPY backdoor sample (redacted) forked from: https://github.com/matthewdunwoody/POSHSPY/

### References

* https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
* https://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
* https://www.youtube.com/watch?v=Ldzr0bfGtHc
