Further reading
If you want to explore some of the topics that were mentioned in this chapter, follow these resources:
- Auditing – further resources:
- Detecting Offensive PowerShell Attack Tools: https://adsecurity.org/?p=2604
- Lee Holmes on downgrade attacks: https://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
- Microsoft SCT: https://www.microsoft.com/en-us/download/details.aspx?id=55319
- PowerShell ♥ the Blue Team: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
- Windows 10 and Windows Server 2016 security auditing and monitoring reference: https://www.microsoft.com/en-us/download/details.aspx?id=52630
- PowerShell post-exploitation, the Empire has fallen, You CAN detect PowerShell exploitation by Michael Gough: https://de.slideshare.net/Hackerhurricane/you-can-detect-powershell-attacks
- EventList:
- GitHub: https://github.com/miriamxyra/EventList
- Black Hat presentation 2020 (version 2.0.0): https://www.youtube...
