[BLUE TEAMING] - Windows PowerShell logs to investigate an attack and perform corrective action

<aside> 💡 PowerShell Logging - commands can be audited in the Windows Event Log

• [Full Event Log View] is a useful alternative </aside>

<aside> 💡 There is a concept known as Living off the Land, which means attackers use the legitimate programs and processes to perform malicious actions and not install anything other than what’s already present. So its never a bad idea to look through the most common directories.

</aside>

<aside> 💡 PowerShell is a cross-platform task automation tool, runs on every OS.

</aside>

<aside> 💡 PowerShell Logging, auditing commands in PowerShell console could be done from anywhere.

</aside>

<aside> 💡 Each command /script when run in PowerShell is logged in Windows Event Log System.

</aside>

Questions ➖

1 - view the github file too

2, 3, 4, 5 - Use Full Event Log Viewer capabilities

6 - Change the filter

7 - Modify the decryptor file, place the key and ciphertext and run the file