Powershell Command Execution Event logs
Monitoring PowerShell Command Execution Logs for Threat Detection
PowerShell’s extensive capabilities make it a prime target for abuse by attackers. Monitoring PowerShell logs, particularly Event ID 4104, helps detect potential malicious activities by capturing detailed command execution events. Here's how to leverage these logs effectively.
Key Event ID: 4104 - PowerShell Command Execution
Log Location: Application and Services Logs → Microsoft → Windows → PowerShell → Operational
Task Category: Executing a Remote Command
Event Level: Verbose
Why It’s Important: Captures PowerShell commands executed in a session, providing visibility into potentially malicious actions.
Steps for Analyzing PowerShell Logs
1. Filter Logs
Event ID: Focus on 4104 to capture PowerShell command execution.
Event Level: Use Verbose to access detailed command data.
Date/Time: Narrow down to the specific incident timeframe to focus your analysis.
Filtering helps reduce noise from routine administrative tasks and highlights critical command execution events.
2. Identify Commands
Key Field: Look for the Creating Scriptblock field in the event details, which contains the executed PowerShell command.
Streamline Analysis: Ignore redundant entries like "prompt" commands unless context suggests they are significant.
3. Analyze Executed Commands
Focus on commands that indicate potential malicious activity, especially during post-exploitation phases.
Example Reconnaissance Commands:
whoami: Identifies the current user and their privileges.
Get-LocalUser: Lists all local user accounts.
Get-LocalGroup: Displays local groups, helping attackers identify privilege escalation opportunities.
Indicators of Malicious Activity
1. Suspicious Commands
Look for known malicious or suspicious command patterns, such as:
Downloading or executing scripts from the web:
Credential dumping (e.g., using Mimikatz):
2. User and Domain Verification
Verify the user account running PowerShell commands.
Check if the account should have legitimate access to PowerShell.
Domain context: Analyze whether PowerShell commands are run from unusual domains or unauthorized devices.
3. Command Patterns
Frequent use of enumeration commands like
Get-LocalUserandGet-LocalGroup.Sequential execution of commands for lateral movement or privilege escalation.
Use Case Example
Scenario: An attacker gains initial access to a system. PowerShell logs show:
whoami: Confirms current access level.
Get-LocalUser/Get-LocalGroup: Enumerates local users and groups for privilege escalation.
New-LocalUser: Creates a backdoor user for persistence.
Analysis: By correlating PowerShell logs with other security logs (e.g., authentication logs, file access logs), the security team identifies unauthorized access and isolates the system to prevent further damage.
Recommendations for Effective Monitoring
1. Enable PowerShell Logging
Enable all logging modes for PowerShell:
Module Logging: Tracks loaded PowerShell modules.
Script Block Logging: Captures detailed command execution (Event ID 4104).
Transcription Logging: Records full PowerShell session transcripts.
2. Automate Detection with SIEM
Set Alerts for Event ID 4104: Use a SIEM solution to automatically detect suspicious PowerShell commands.
Monitor Anomalous Patterns: Alert on uncommon PowerShell usage from specific users, devices, or IP ranges.
3. Correlate with Other Logs
Combine PowerShell logs with:
Authentication logs (Event ID 4624, 4625).
Scheduled Task logs (Event IDs 4698, 4702).
Process creation logs (Sysmon Event ID 1).
This provides a more comprehensive view of an incident.
4. Restrict PowerShell Usage
Limit PowerShell access to administrative accounts only.
Deploy Constrained Language Mode to restrict PowerShell functionality for non-admin users.
5. Use Threat Intelligence
Cross-reference executed commands with known Indicators of Compromise (IOCs).
Monitor for uncommon scripts or tools downloaded via PowerShell.
Key Points
Monitoring Event ID 4104 provides a window into potentially malicious PowerShell activity. By focusing on command execution patterns, user behavior, and script content, security teams can detect and respond to attacks involving PowerShell, such as reconnaissance, credential theft, and persistence. Combining these logs with other system logs enhances incident detection and response, helping to safeguard critical assets.
Last updated