Power Shell Logs Forensic Analysis

Roberto Rodriguez wrote a post in which he demonstrated detailed steps for the introduction, consumption and analysis of the logs. First, when he talks about the improved logging of PowerShell. He’s talking about including a block log and scripts.

We hope that this information was useful for those who were not familiar with the benefits of advanced PowerShell logging and with the process implementing it in your environment. This is not the last article of Roberto, he even plans to use the same approach and new logging capabilities to document the templates and events that are created by several post-operation techniques available in the PowerShell Empire.

If you want to contribute and document the patterns / behavior of opponents recorded by event logs, do not hesitate, feedback is very important.

More.