Summary

In this chapter, you learned what PowerShell is, why attackers prefer PowerShell, PowerShell’s usage in different attack phases, the events and logs provided by Microsoft that allow you to track PowerShell execution activity, and examples of techniques and command-line arguments typical of PowerShell attacks.

In the next chapter, you will learn a list of the persistence and lateral movement techniques and how to investigate and track them using the event logs provided by Microsoft.