Hunting for Malicious PowerShell using Script Block Logging

[melissap]

View our Tech Talk: Security Edition, Hunting for Malicious PowerShell using Script Block Logging 

The Splunk Threat Research Team most recently began evaluating more ways to generate security content using native Windows event logging regarding PowerShell Script Block Logging. This method provides greater depth of visibility as it provides the raw (entire) PowerShell script output. There are three sources that may enhance any defender's perspective: module, script block and transcript logging. We focused our security content on script block logging (4104) as it provides the most granular visibility of PowerShell scripts that execute on an endpoint. However, we also provided a way to gather all three for testing validation, production or curiosity.

Tune in to this Tech Talk to learn about:

• What is a malicious powershell
• How to detect malicious powershell with script block logging
• How to implement threat hunting in your operations to prevent breaches

[melissap]

Here are some follow up materials to continue on your journey.

1. Splunk content updates on Github
2. Blog: PowerShell Detections
3. Splunk Community Slack
• splunk-usergroups.slack.com 
4. Splunk Security Threat Research Team website
5. Splunk Answers community of ES Content Update

[mfiller_schell]

This is EXCELLENT

Would love to see more