1/ Number #4 of the #ActiveDirectory hardening measures:
PowerShell Script Block Logging
🧵 #CyberSecurity
PowerShell Script Block Logging
🧵 #CyberSecurity
2/ Strictly speaking not part of a guide about hardening AD, but I must stress once again the importance of logging executed PowerShell code on clients and servers:
And here with several examples from our Incident Response cases:
https://twitter.com/malmoeb/status/1608796598888452097
And here with several examples from our Incident Response cases:
https://twitter.com/malmoeb/status/1627214815012716546
3/ There are other opinions about PowerShell Script Block logging because, potentially, passwords or other sensitive data could end up in event logs, and authenticated users on the workstation or server could read these logs, thus giving away the sensitive data. [1]
4/ My opinion about this topic:
5/ As a bonus, we recommend our customers to install Sysmon on critical systems like DCs or Exchange servers if they do not have an EDR in place.
In case of an incident, we could at least collect and evaluate the Sysmon logs, which would speed up the investigation.
In case of an incident, we could at least collect and evaluate the Sysmon logs, which would speed up the investigation.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
