You're reading from PowerShell Automation and Scripting for Cybersecurity Hacking and defense for red and blue teamers

Product type Paperback

Published in Aug 2023

Publisher Packt

ISBN-13 9781800566378

Length 572 pages

Edition 1st Edition

Languages

PowerShell

Tools

PowerShell

Concepts

Cybersecurity

Author (1):

Miriam C. Wiesner

View More author details

Table of Contents (19) Chapters

Preface

1. Part 1: PowerShell Fundamentals

2. Chapter 1: Getting Started with PowerShell FREE CHAPTER

3. Chapter 2: PowerShell Scripting Fundamentals

4. Chapter 3: Exploring PowerShell Remote Management Technologies and PowerShell Remoting

5. Chapter 4: Detection – Auditing and Monitoring

6. Part 2: Digging Deeper – Identities, System Access, and Day-to-Day Security Tasks

7. Chapter 5: PowerShell Is Powerful – System and API Access

8. Chapter 6: Active Directory – Attacks and Mitigation

9. Chapter 7: Hacking the Cloud – Exploiting Azure Active Directory/Entra ID

10. Chapter 8: Red Team Tasks and Cookbook

11. Chapter 9: Blue Team Tasks and Cookbook

12. Part 3: Securing PowerShell – Effective Mitigations In Detail

13. Chapter 10: Language Modes and Just Enough Administration (JEA)

14. Chapter 11: AppLocker, Application Control, and Code Signing

15. Chapter 12: Exploring the Antimalware Scan Interface (AMSI)

16. Chapter 13: What Else? – Further Mitigations and Resources

17. Index

Why subscribe?

18. Other Books You May Enjoy

Configuring PowerShell Event Logging

Implementing robust auditing mechanisms for PowerShell to help you monitor, detect and prevent potential threats is an essential step to ensure effective security practices for PowerShell. By leveraging PowerShell logging, you can capture detailed information about PowerShell activities on your systems, which is essential for detecting and investigating security incidents. PowerShell logging can help you identify suspicious activities, such as the execution of malicious commands or the modification of critical system settings.

In this section, we will discuss the different types of PowerShell logging that you can enable, including PowerShell Module Logging, PowerShell Script Block Logging, Protected Event Logging, and PowerShell transcripts. We will also look into how to configure these logging features to meet your organization’s specific security requirements.