View our Tech Talk: Security Edition, Hunting for Malicious PowerShell using Script Block Logging
This is a modal window.
Beginning of dialog window. Escape will cancel and close the window.
End of dialog window.
This is a modal window. This modal can be closed by pressing the Escape key or activating the close button.
The Splunk Threat Research Team most recently began evaluating more ways to generate security content using native Windows event logging regarding PowerShell Script Block Logging. This method provides greater depth of visibility as it provides the raw (entire) PowerShell script output. There are three sources that may enhance any defender's perspective: module, script block and transcript logging. We focused our security content on script block logging (4104) as it provides the most granular visibility of PowerShell scripts that execute on an endpoint. However, we also provided a way to gather all three for testing validation, production or curiosity.
Tune in to this Tech Talk to learn about:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.