A Huntress SOC team walkthrough of a real-world PowerShell reverse shell attack discovered via their Managed EDR tool. The attacker gained access through a compromised ScreenConnect RMM instance, deployed an obfuscated Base64-encoded PowerShell payload that fetched additional scripts from a staging domain, installed OpenSSH, created firewall rules, and established persistent SSH reverse shell tunnels back to an attacker-controlled IP. The post decodes the payload step-by-step using CyberChef and closes with defensive recommendations: enforce 2FA on RMM tools, monitor network traffic, deploy IDS/IPS, and educate users on download hygiene.
