Greater Visibility Through PowerShell Logging[html]
UPDATE (Feb. 29): This post has been updated with new configuration
recommendations due to the Feb. 24 rerelease of PowerShell 5, and
now includes a link to a parsing script that users may find valuable.
Introduction
Mandiant is continuously investigating attacks that leverage
PowerShell throughout all phases of the attack. A common issue we
experience is a lack of available logging that adequately shows what
actions the attacker performed using PowerShell. In those
investigations, Mandiant routinely offers guidance on increasing
PowerShell logging to provide investigators a detection mechanism for
malicious activity and a historical record of how PowerShell was used
on systems. This blog post details various PowerShell logging options
and how they can help you obtain the visibility needed to better
respond, investigate, and remediate attacks involving PowerShell.
