{"id":135,"date":"2020-07-08T10:56:25","date_gmt":"2020-07-08T10:56:25","guid":{"rendered":"https:\/\/cybersecthreat.com\/?p=135"},"modified":"2024-04-01T13:51:40","modified_gmt":"2024-04-01T05:51:40","slug":"powershell-core-logging","status":"publish","type":"post","link":"https:\/\/cybersecthreat.com\/zh\/2020\/07\/08\/powershell-core-logging\/","title":{"rendered":"PowerShell Core Logging"},"content":{"rendered":"

Many security professionals know the importance of PowerShell logging. It gives us great visibility for the Incident Response and Threat-Hunting process. FireEye wrote a great article about PowerShell logging \u7db2\u5740<\/a>. As Microsoft already launched Power Shell Core, we also need to consider PowerShell Core (PowerShell 6\/7) logging. As a side note, the executable name of PowerShell Core is pwsh.exe<\/strong> and therefore usually co-exists with the original powershell.exe executable. In reality, organizations are shifting more and more workloads to the cloud such as Azure. Both the developer and operation team tend to use more and more PowerShell to manage their cloud instance. I saw some developer and operation teams install PowerShell Core on their own. This may be risky! So, I suggest we turn on the log before they install the tools. <\/p>\n\n\n