PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Guides tagged
#amsi
PowerShell Security
PowerShell security: logging, v2 removal, CLM and JEA
Make PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
Intermediate