Searching Logs & Event Viewer
Searching for sensitive log files & Events can be lead to valuable information about a system and may lead to escalating privileges.
PowerShell Script Block Logging
Two important logging mechanisms for PowerShell are:
PowerShell Transcription
PowerShell Script Block Logging.
Get-WinEvent
Get-WinEvent Microsoft-Windows-PowerShell/Operational | Where-Object Id -eq 4104 | Out-GridView
Get-WinEvent -LogName "Microsoft-Windows-Powershell/Operational" | select -first 20 | Out-Gridviewreq query
reg query HKCU\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
reg query HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
reg query HKCU\Wow6432Node\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
reg query HKLM\Wow6432Node\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLoggingEvent Viewer
If we have access to RDP we can use the Event Viewer GUI to search for logs and event files.
Last updated