Securing PowerShell: Hands-On Lab
summary
Hands-on lab walks through enabling script block logging and system-wide transcription, configuring JEA endpoints and PowerShell Core logging on Windows macOS and Linux, and hunting with Get-WinEvent plus filterXPath/filterXML. Lab materials live on GitHub and run in a 100×3-VM AWS lab; shows using the EICAR/AMSI test string, recommends bumping event logs to 0.5–1 GB, warns about transcript “inception” when searching with PowerShell, demonstrates a PowerShell Empire attack against a hardened Windows 10 VM with Defender disabled, and outlines off‑box collection via Windows Event Forwarding or Tanium.
AI-written summary · about
chapters (10)
- 0:00Start
- 10:04Anti-Malware Scan Interface
- 10:50Windows Event Viewer
- 17:56Event Log Size
- 26:18Windows Event Forwarding
- 28:10Transcription Location
- 38:48How I Wrote the Lab
- 39:05Markdown Converter
- 44:40Encrypted Logging
- 54:22Powershell Is Not a Vulnerability in Your Environment
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
25mInvestigating PowerShell Attacks
49mPowerShell for Security Incident Response
48mStop Writing Insecure PowerShell... Seriously.
43mSecuring your Environment with Just Enough Administration
01h 33mA hands-on lab working
41mHow Secure Can You Be?
49mAdvanced Network Scripting with PowerShell