Detection – Auditing and Monitoring

Although organizations already try to harden their environments, only a few take into account that auditing and monitoring are two of the most important things when it comes to securing your environment.

For many years while working at Microsoft, I have preached the protect, detect, and respond approach. Most companies try to just protect their devices, but that’s where they stop. To detect and respond, there needs to be not only a working Security Operations Center (SOC) in place but also infrastructure and resources.

Those people and resources require money – a budget that many companies don’t want to spend in the first place, unless they have been breached.

When working with customers, I saw only a few environments with a working SOC in place, as well as the infrastructure to host a Security Information and Event Management (SIEM) system. I was really happy that when I left those customers, most of them started...

Technical requirements

To get the most out of this chapter, ensure that you have the following:

• PowerShell 7.3 and above.
• Access to the GitHub repository for Chapter04:

https://github.com/PacktPublishing/PowerShell-Automation-and-Scripting-for-Cybersecurity/tree/master/Chapter04

Configuring PowerShell Event Logging

Implementing robust auditing mechanisms for PowerShell to help you monitor, detect and prevent potential threats is an essential step to ensure effective security practices for PowerShell. By leveraging PowerShell logging, you can capture detailed information about PowerShell activities on your systems, which is essential for detecting and investigating security incidents. PowerShell logging can help you identify suspicious activities, such as the execution of malicious commands or the modification of critical system settings.

In this section, we will discuss the different types of PowerShell logging that you can enable, including PowerShell Module Logging, PowerShell Script Block Logging, Protected Event Logging, and PowerShell transcripts. We will also look into how to configure these logging features to meet your organization’s specific security requirements.

PowerShell Module Logging

PowerShell Module Logging was added with PowerShell...

Analyzing event logs

There are several ways to work with Windows event logs using PowerShell. Of course, you can always forward your event logs to the SIEM of your choice, but sometimes, it happens that you want to directly analyze the event logs on a certain machine. For this use case, it makes sense to look at the available options that come with PowerShell.

The easiest option if you just want to analyze events or create new events is the *-WinEvent cmdlets, which are still available in PowerShell Core 7. You can use Get-Command to find all available cmdlets:

Figure 4.10 – The available *-WinEvent cmdlets

In PowerShell 5.1, there was also the possibility of using the *-EventLog cmdlets, but they were removed in PowerShell Core 6 and above. Since PowerShell 5.1 is installed by default on all Windows 10 operating systems, I refer to *-EventLog here. Again, use Get-Command to find all available cmdlets:

Figure 4.11 ...

Getting started with logging

To improve your detection, it makes sense to set up a SIEM system for event collection so that you have all event logs in one place, allowing you to hunt and even build automated alerting.

There are many options if you want to choose a SIEM system – for every budget and scenario. Over the years, I have seen many different SIEM systems – and each one just fitted perfectly for each organization.

The most popular SIEM systems that I have seen out in the wild were Splunk, Azure Sentinel, ArcSight, qRadar, and the “ELK stack” (Elastic, LogStash, and Kibana), just to mention a few. I also saw and used Windows Event Forwarding (WEF) to realize event log monitoring.

Of course, it is also possible to analyze events on a local machine, but it is not practical – depending on the configuration, if the maximum log size is reached, old events are deleted, and you cannot easily correlate them with logs from another system.

...

Summary

In this chapter, you learned how to get started with security logging for PowerShell. You now know which event logs are of interest and which event IDs you should look for. As security monitoring is a huge topic, you have learned just the basics on how to get started and continue.

You learned how to configure PowerShell Module Logging, Script Block Logging, and PowerShell transcripts – manually and centralized for Windows PowerShell, as well as for PowerShell Core.

Another important learning point is that log events can be tampered with, and you can implement some level of protection using Protected Event Logging.

Eventually, it is best to forward your log events to a centralized SIEM system, but if that’s not possible, you also learned how to analyze events using PowerShell.

Now that you have been provided with some example scripts and code snippets, you are ready to investigate all PowerShell activity on your clients and servers.

Last but not...

Further reading

If you want to explore some of the topics that were mentioned in this chapter, follow these resources:

• Auditing – further resources:
  • Detecting Offensive PowerShell Attack Tools: https://adsecurity.org/?p=2604
  • Lee Holmes on downgrade attacks: https://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
  • Microsoft SCT: https://www.microsoft.com/en-us/download/details.aspx?id=55319
  • PowerShell ♥ the Blue Team: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
  • Windows 10 and Windows Server 2016 security auditing and monitoring reference: https://www.microsoft.com/en-us/download/details.aspx?id=52630
  • PowerShell post-exploitation, the Empire has fallen, You CAN detect PowerShell exploitation by Michael Gough: https://de.slideshare.net/Hackerhurricane/you-can-detect-powershell-attacks
• EventList:
  • GitHub: https://github.com/miriamxyra/EventList
  • Black Hat presentation 2020 (version 2.0.0): https://www.youtube...