Once you have logging set up, you can then look in the PowerShell event log for events. This can capturing PowerShell commands of lateral movements.įinally make sure your PowerShell event log is increased to 1 gigabyte (or as large as your environment can have), and consider a logging solution that will move these files off machines for later review if you have a sensitive and secure environment. It provides a record of the PowerShell session, plus input and output, exactly as it appears in the session. If you are concerned about attacks and password grabbing, PowerShell Transcription logging can be very effective in identifying scripts that are run by attackers. Merely adding script block logging means that you can capture quite a bit of detail. It’s not recommended to enable the start and stop of script blocks, as this adds a large amount of logging events. This records when blocks of code executed, thus capturing the code executed by an attacker including scripts and commands. The next logging item to set up is “Turn on PowerShell Script Block logging”. Use the wild card to initially set up logging.

Alternatively, you can enter * to log all modules.

To obtain a list of modules, use the Get-Module -ListAvailable PowerShell cmdlet and then add the modules you want to audit. You’ll want to determine what modules you want to track. The first, “Turn on Module logging”, records portions of scripts and de-obfuscated code, and will log events to event ID 4103 in the Windows PowerShell log.

Go to Administrative Templates, then Windows Components and then Windows PowerShell. Next enable logging through Group Policy by configuring it as follows: Once this is in place, you can use the abilities of PowerShell 5 on Windows 7 and turn on the enhanced logging that 5 provides.

With the first two steps done, you can install Windows Management Framework 5.1.

Install Windows Management Framework 4.0.

Windows powershell windows 7