PowerShell activity

Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: artefacts.help.

Overview

Windows PowerShell version 2.0, and prior versions, provide few useful audit settings, thereby limiting the availability of evidence (such as a command history).

Upon executing any PowerShell command or script, either locally or using PS remoting, Windows may write events to the following hives:

Windows PowerShell.evtx
Microsoft-Windows-PowerShell\Operational.evtx
Microsoft-Windows-PowerShell\Analytic.etl (non default)

Starting with PowerShell v5 on Windows 10, the commands entered in a PowerShell console will be logged by the PSReadline module to an user-scoped ConsoleHost_history.txt file. Console-less PowerShell sessions, such as the content of PowerShell script or commands execution through the PowerShell ISE, will not be logged in this file. By default, the ConsoleHost_history.txt file will be located under: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Bypassing PSReadline logging is however easy, as it simply requires to unload the PSReadline module (for instance with the Remove-Module PSReadline in an existing PowerShell session).

As PowerShell implements its remoting functionality through the Windows Remote Management (WinRM) service, remote PowerShell activity may induce events in the following hives:

Microsoft-Windows-WinRM\Operational.evtx
Microsoft-Windows-WinRM\Analytic.etl (non default)

The events linked to remote PowerShell activity, conducted through the WinRM service, are detailed in the Lateral movements section.

Additionally, if enabled, AppLocker will record PowerShell activity in the Microsoft-Windows-AppLocker\MSI and Script hive.

Note that PowerShell 2.0, and prior versions, provide limited logging capacities and thereby limit the availability of evidence, such as the interactive command history executed through PowerShell console.

The events providing command line / command history information should be searched for the following keywords (case insensitive search):

-Enc / -e
-nop / bypass
IEX / Invoke-Expression
ICM / Invoke-command
Net.WebClient / io.
DownloadString / DownloadFile
& / |
// / http / ftp / cifs / smb / etc.
join / nioj / replace / ecalper / -f / CHAR / RAHC / STRING / GNIRTS / marshal / convert / env / { / } (obfuscation detection)

While the occurrence of these keywords may entail malicious activities, their absence is not a formal proof of lack of malicious PowerShell activity as PowerShell code can be deeply obfuscated.

PowerShell deobfuscation

The PSDecode PowerShell script can be used to deobfuscate malicious PowerShell scripts that have several layers of encodings.

https://github.com/R3MRUM/PSDecode

Import-Module PSDecode.psm1

PSDecode <ENCODED_POWERSHELL_FILE>

PowerShell Windows events

Hive

Event ID

Conditions

Description

Windows PowerShell

400

PowerShell 2.0

Engine state is changed from None to Available. Logged on the start of any local or remote PowerShell activity (execution of powershell.exe). The HostApplication field record the binary path at the origin of the powershell activity and contain the commandline arguments provided to powershell.exe. If the Hostname field is equal to : - ConsoleHost, the event concern a local activity - ServerRemoteHost, the event occured du to PowerShell remoting activity. The RunaspaceId identify the PowerShell activity and can be linked to the session termination (EID 403). Note that however this event cannot be strictly correlated to a logon session.

Windows PowerShell

403

PowerShell 2.0

Engine state is changed from Available to Stopped. Logged at the end of any local or remote PowerShell activity (execution of powershell.exe) and contains the same level of information as the EID 400 events. The RunaspaceId identify the PowerShell activity and can be linked to the session start (EID 400). Note that however this event cannot be strictly correlated to a logon session.

Windows PowerShell

500

PowerShell 2.0 Requires $LogCommandLifeCycleEvent to be set to true (non default)

Command "<COMMAND>" is Started. Logged whenever a PowerShell command is executed, but can be bypassed by starting PowerShell using the -NoProfile / -nop flag.

Windows PowerShell

501

PowerShell 2.0 Requires $LogCommandLifeCycleEvent to be set to true (non default)

Command "<COMMAND>" is Stopped. Logged whenever a PowerShell command finish its execution, but can be bypassed by starting PowerShell using the -NoProfile / -nop flag.

Windows PowerShell

600

PowerShell 2.0

Provider "<PROVIDER_NAME>" is Started. Logs the start and stop of PowerShell providers. Similarly to the events EID 400 and EID 403, this event include the HostApplication field. If the provider is WSMan ("Provider WSMan Is Started"), the event, logged on both the client and remote systems, indicate the use of PS remoting. If the PowerShell activity relies on built-in alias, such as IEX, an event will be generated for the Alias provider.

Windows PowerShell

800

PowerShell 3.0

Pipeline execution details for command line. Inconsistently logged. Similarly to the events EID 400 and EID 403, this event include the HostApplication field and present the advantage of logging, in the UserId field, the user account executing PowerShell.