PowerShell Intrusion Analysis
Introduction
PowerShell has become an indispensable tool in Digital Forensics and Incident Response (DFIR), offering unparalleled flexibility and efficiency for investigating and responding to cyber incidents. As a robust command-line shell and scripting language, PowerShell is built into Windows operating systems, making it readily accessible for both system administrators and DFIR analysts.
Its importance lies in its ability to query, interact with, and manipulate nearly every aspect of a Windows system. PowerShell provides analysts with powerful cmdlets and scripts to gather forensic artefacts, analyse logs, investigate execution activity, and automate repetitive tasks. Furthermore, its deep integration with Windows APIs and system internals allows for rapid data collection and analysis during an active investigation.
In addition to its forensic capabilities, PowerShell is a critical tool for incident response. It can be used to identify active threats, terminate malicious processes, block network connections, and remediate compromised systems in real-time. However, its power also makes it a favourite tool of attackers, emphasising the need for DFIR professionals to understand its capabilities fully—not only to leverage it for defence but also to detect its misuse.
Mastering PowerShell equips DFIR practitioners with the skills to efficiently analyse systems, respond to threats, and bolster an organisation\u2019s cybersecurity posture in today\u2019s fast-paced and complex threat landscape.
Get General insight and System Information
Get System Information:
Get-ComputerInfoGet Operating System Details:
Get-WmiObject -Class Win32_OperatingSystemGet Hardware Information:
Get-WmiObject -Class Win32_ComputerSystemGet Installed Software:
Get-WmiObject -Class Win32_ProductCheck For Local User Accounts:
Get-LocalUserGet the last logon time for the user “John” by using
Retrieve information about users and their last logon times:
Get more detailed information, including last logon times
Let's say John is a suspicious user here, and we need to investigate this. Retrieve detailed information about the user John:
List the groups that the user John is a member of
Networking Information Gathering
Get network configuration
Get active network connections
Get DNS information
Check if there is a record defined with
List network routes now
We need to do some more detailed research
And
To see if ports 139 and 445 are actively listening on your system
To inspect firewall rules related to ports 139 and 445
To identify which processes are using ports 139 or 445
To verify SMB configuration and settings
Determine if the machine is part of an Active Directory (AD) domain
Retrieve more detailed information about the domain membership
User Accounts and Groups
Inspect user accounts and groups
Check membership for suspect user “John” in each group
Check for the privilege of the suspect user
Check if the user “John” has any scheduled tasks:
Check if the user “Jenny” has any scheduled tasks:
Get Schedule Task Information
Get general information about tasks:
Get some general details about scheduled tasks
To determine if a scheduled task is suspicious, focus on understanding its purpose, verifying its actions, and comparing it against known legitimate tasks in your environment.
Use:
Use:
"You need to specifically look at the Clean file system entry. This is highly suspicious and attempts to destroy evidence or something like that. You can use PowerShell commands effectively to gather detailed information about a scheduled task, including its properties and actions.
Use:
Display all properties for a detailed analysis of the task now
You can perform a detailed analysis of a task by running the following
The MSFT_TaskDailyTrigger class provides properties that define how often the task runs, at what time, and any intervals or repetitions required. Here are some key properties of MSFT_TaskDailyTrigger
Then use it:
Or you can use:
Check Startup Programs
To access and display the values under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Get Processes
Review the security event logs for login activities related to the user “John”:
Investigate if the user “John” and “Jenny” has any scheduled tasks:
Check for processes currently running under the user “John”:
Look for activities performed by the user “John” in the system and application event logs:
Now let’s get general details via System logs:
Get the scheduled tasks:
Double-check the daily running task:
Get more detailed information about this:
We have witnessed suspicious scripts and activities found in the TMP location.
Check the contents of the Temp file location:
Identify if any running processes are executing from the TMP directory:
Look at the contents of some files in TMP:
Take a look at the startup entries again:
Look at the security logs again:
Look for logs signed with 4672 or other Eventlog
Create a detailed query:
Check for any suspicious registry entries that might point to Temp:
Get a registry entry associated with a suspect file, for instance, mim.exe
Check the properties of mim.exe to gather more information about it:
Check digital signatures to verify if mim.exe is digitally signed:
Compute the hash of the file and check it against known malware databases like VirusTotal
Check if there are any scheduled tasks related to mim.exe.
Check for other startup entries that might reference mim.exe.
Below, we can write two more queries that you can use for log files.
Determine the system information and user details
Check group memberships for a user
Check the profile path and home directory for the user, for instance, "sam"
Get the system event log
To reveal registry added or changing activity using Get-WinEvent for the System log, you can filter for specific Event IDs related to registry changes. Common Event IDs for registry changes include:
4656: A handle to an object was requested.
4657: A registry value was modified.
4663: An attempt was made to access an object.
4659: A handle to an object was requested with the intent to delete. You can use:
For a word-based search, the following command is useful:
Scheduled tasks might be used to execute the malicious scripts periodically or at specific events:
If PowerShell was used to execute commands, you can check the PowerShell history:
Startup programs could include the malicious payload or its components:
Let’s create a query for events:
Circular Log Type: This indicates that the log file is configured to overwrite old entries with new ones once the log reaches its maximum size. This is useful for logs that accumulate data continuously.
Size: The size of the log file in bytes.
Number of Entries: The number of events currently logged in that file. For example, We found events recorded as Admin and Operational. Investigate it:
If you want to search for specific patterns in the log files, you can use Select-String as follows:
Verify that a file, for example, ualapi.dll is legitimate and hasn’t been tampered with:
Obtain the process information defined in the ualapi.dll file event:
Or:
PowerShell Incident Response Resources
Powershell Digital Forensics & Incident Response (DFIR) - The repository contains multiple PowerShell scripts that can help you respond to cyber attacks on Windows Devices. (Credit Bert-JanP)
PowerShell Commands for Incident Response - Learn different PowerShell Commands that can be used in Incident Response to remediate the machine. (written by Ayush Anand)
How to Run PowerShell Script on Remote Computers - The article looks at several examples of how to use PowerShell Remoting interactive session mode and persistent connections to run PS1 a script on a remote computer. (written by Cyril Kardashevsky )
CyberRaiju - Digital Forensics and Incident Response (written by Jai Minton)
Last updated