Saved searches
Use saved searches to filter your results more quickly
Cancel Create saved search
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.
This repository has been archived by the owner on Oct 29, 2021. It is now read-only.
Unexpected Write into C:\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive #143
claudiospizzi opened this issue Mar 12, 2020 · 2 comments
Unexpected Write into C:\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive #143
claudiospizzi opened this issue Mar 12, 2020 · 2 comments
bug Something isn’t working
Comments
claudiospizzi commented Mar 12, 2020
Describe the Issue
I’m not sure why, but Universal Automation hosted in IIS tries to write into the C:\ root to write some startup profile data. In my case, the IIS user doesn’t have the permissions to write into that folder:
- C:\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
To Reproduce
$uaServerSplat = @ < ConnectionString = 'C:\PathToDatabase.db' RepositoryPath = 'C:\PathToRepo' GitRemote = 'https://repourl' GitRemoteCredential = $cred InProcess = $true >Start-UAServer @uaServerSplat Expected behavior
Not sure where this comes from. Would be great if this is redirected either to the users app data or the global C:\ProgramData .
Screenshots
Version Information
- Host Operating System: WS2019
- Host PowerShell Version: 5.1
- Universal Automation Version: 1.0.1
- Universal Dashboard Version:2.9.0
- UD Hosting Method: IIS
The text was updated successfully, but these errors were encountered:
Powershell in NonInteractive mode
I use Octopus for our deployments. I have a problem with one of the Powershell scripts to control the deployment:
# stops running processes $processes = @("Notepad", "Firefox") foreach ($process in $processes) < $prc = Get-Process -Name $process -ErrorAction SilentlyContinue if (-not($prc -eq $null)) < Write-Host "Stopping " $prc.ProcessName Stop-Process -InputObject $prc -ErrorAction SilentlyContinue >> The programs I try to stop are not the ones you see in the script above, but they represent what I am trying to do. Now the problem I have with it, is that it works well on one server, but not on another. Where it does not work, I get the error message: Stop-Process : Windows PowerShell is in NonInteractive mode. Read and Prompt functionality is not available. The script that works runs on Powershell 3.0, the one that does not work on Powershell 2.0. I cannot upgrade to Powershell 3.0 everywhere yet because the old servers run with Windows Server 2003. How can I make it work on PS 2.0?
Invoke-Mimikatz (PowerSploit)
Category Password and Hash Dump Description Loads Mimikatz into memory and starts it up. Example of Presumed Tool Use During an Attack This tool is used to acquire the user’s password and use it for unauthorized login.
— Tool Operation Overview
| Item | Source Host | Destination Host |
|---|---|---|
| OS | Windows | |
| Belonging to Domain | Not required | |
| Rights | Administrator | |
| Communication Protocol | 5985/tcp (HTTP), 5986/tcp (HTTPS) | |
| Service | Windows Remote Management | |
— Information Acquired from Log
- Source host
- Execution history (Prefetch)
- Details of the script/command executed (Windows 10 only. They are recorded in «Microsoft-Windows-PowerShell/Operational» and C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- Source host
- Execution history (audit policy, Sysmon)
- A record of communication using WinRM (5985/tcp) (audit policy, Sysmon)
- Details of the script/command executed (when Windows Management Framework 5.0 is installed on Windows 7. They are recorded in «Microsoft-Windows-PowerShell/Operational» and C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- A record of communication using WinRM (5985/tcp) (audit policy, Sysmon)
— Evidence That Can Be Confirmed When Execution is Successful
- Source Host: The Event ID: 4104 is recorded in the event log «Microsoft-Windows-PowerShell/Operational», and its contents include a Invoke-Mimikatz script (Windows 10, or when Windows Management Framework 5.0 is installed on Windows 7).
— Main Information Recorded at Execution
— Source Host
Event log
- CommandLine : Command line of the execution command («C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe»)
- UtcTime : Process execution date and time (UTC)
- ProcessGuid/ProcessId : Process ID
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- User : Execute as user
- Connect String : Host name (source host)
- Message : The content of the script executed. The content of the executed PowerShell script is recorded as is.
- Protocol : Protocol (tcp)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- SourceIp/SourceHostname/SourcePort : Source IP address/Host name/Port number (source host)
- DestinationIp/DestinationHostname/DestinationPort : Destination IP address/Host name/Port number (destination port: 5985)
USN journal
# File Name Process 1 ConsoleHost_history.txt CLOSE+DATA_EXTEND UserAssist
# Registry Data 1 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\\Count\\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr Date and time of the initial execution, Total number of executions MFT
# Path Header Flag Validity 1 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt FILE ALLOCATED Prefetch
- C:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf
— Destination Host
Event log
- Protocol : Protocol (tcp)
- Image : Path to the executable file (System)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- SourceIp/SourceHostname/SourcePort : Source IP address/Host name/Port number (destination port: 5985)
- DestinationIp/DestinationHostname/DestinationPort : Destination IP address/Host name/Port number (source host)
- ParentImage : Executable file of the parent process (C:\Windows\System32\svchost.exe)
- CommandLine : Command line of the execution command (C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding)
- ParentCommandLine : Command line of the parent process (C:\Windows\system32\svchost.exe -k DcomLaunch)
- UtcTime : Process execution date and time (UTC)
- ProcessGuid/ProcessId : Process ID
- Image : Path to the executable file (C:\Windows\System32\wbem\WmiPrvSE.exe)
- Operation : Requested process (CreateShell)
Prefetch
- C:\Windows\Prefetch\WSMPROVHOST.EXE-[RANDOM].pf
— Details: Source Host
— USN Journal
# File Name Process Attribute 1 POWERSHELL.EXE-[RANDOM].pf FILE_CREATE archive POWERSHELL.EXE-[RANDOM].pf FILE_CREATE+SECURITY_CHANGE archive POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+FILE_CREATE+SECURITY_CHANGE archive POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive POWERSHELL.EXE-[RANDOM].pf BASIC_INFO_CHANGE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive POWERSHELL.EXE-[RANDOM].pf BASIC_INFO_CHANGE+CLOSE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive 2 POWERSHELL.EXE-[RANDOM].pf DATA_TRUNCATION archive POWERSHELL.EXE-[RANDOM].pf DATA_EXTEND+DATA_TRUNCATION archive POWERSHELL.EXE-[RANDOM].pf CLOSE+DATA_EXTEND+DATA_TRUNCATION archive 3 CustomDestinations FILE_CREATE directory CustomDestinations CLOSE+FILE_CREATE directory 4 [RANDOM].customDestinations-ms FILE_CREATE archive [RANDOM].customDestinations-ms FILE_CREATE+SECURITY_CHANGE archive [RANDOM].customDestinations-ms DATA_EXTEND+FILE_CREATE+SECURITY_CHANGE archive [RANDOM].customDestinations-ms DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive [RANDOM].customDestinations-ms BASIC_INFO_CHANGE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive [RANDOM].customDestinations-ms BASIC_INFO_CHANGE+CLOSE+DATA_EXTEND+DATA_OVERWRITE+FILE_CREATE+SECURITY_CHANGE archive 5 [RANDOM].customDestinations-ms~RF[RANDOM].TMP FILE_CREATE hidden+archive+temporary [RANDOM].customDestinations-ms~RF[RANDOM].TMP CLOSE+FILE_CREATE hidden+archive+temporary [RANDOM].customDestinations-ms~RF[RANDOM].TMP CLOSE+FILE_DELETE hidden+archive+temporary 6 [RANDOM].ps1 FILE_CREATE archive [RANDOM].ps1 DATA_EXTEND+FILE_CREATE archive [RANDOM].ps1 CLOSE+DATA_EXTEND+FILE_CREATE archive [RANDOM].ps1 CLOSE+FILE_DELETE archive 7 [RANDOM].psm1 FILE_CREATE archive [RANDOM].psm1 DATA_EXTEND+FILE_CREATE archive [RANDOM].psm1 CLOSE+DATA_EXTEND+FILE_CREATE archive [RANDOM].psm1 CLOSE+FILE_DELETE archive 8 ConsoleHost_history.txt DATA_EXTEND archive ConsoleHost_history.txt CLOSE+DATA_EXTEND archive — Event Log
- LogonGuid/LogonId : ID of the logon session
- ParentProcessGuid/ParentProcessId : Process ID of the parent process
- ParentImage : Executable file of the parent process
- CurrentDirectory : Work directory
- CommandLine : Command line of the execution command («C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe»)
- IntegrityLevel : Privilege level
- ParentCommandLine : Command line of the parent process
- UtcTime : Process execution date and time (UTC)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user
- Hashes : Hash value of the executable file (High)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Process Information > Required Label : Necessity of privilege escalation
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Process Information > Source Process Name : Path to parent process that created the new process
- Log Date and Time : Process execution date and time (local time)
- Process Information > New Process Name : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Process Information > Token Escalation Type : Presence of privilege escalation (1)
- Process Information > New Process ID : Process ID (hexadecimal)
- Process Information > Source Process ID : Process ID of the parent process that created the new process. «Creator Process ID» in Windows 7
- Subject > Logon ID : Session ID of the user who executed the process
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile, and AppendData)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (WriteData or AddFile, AppendData)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- ProcessGuid/ProcessId : Process ID
- TargetFilename : Created file (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
- CreationUtcTime : File creation date and time (UTC)
- UtcTime : Date and time the change occurred (UTC)
- CreationUtcTime : New timestamp (UTC)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- PreviousCreationUtcTime : Old timestamp (UTC)
- TargetFilename : Name of the file changed (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
- Process Information > Process ID : Process ID (hexadecimal)
- Audit Success : Success or failure (change successful)
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].temp)
- Subject > Account Name : Name of the account that executed the tool
- Subject > Account Domain : Domain to which the account belongs
- Change permissions > New security descriptor : Security descriptor after the change (D:ARAI(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;[SID])(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;[SID]))
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Change permissions > Original security descriptor : Security descriptor before the change (D:(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;[SID]))
- Subject > Security ID : SID of the user who executed the tool
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile, and AppendData)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Target category
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms~[RANDOM].TMP)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including SYNCHRONIZE, and WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (SYNCHRONIZE, WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Target category
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege (including DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[ALPHANUM].customDestinations-ms~[ALPHANUM].TMP)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege (DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[ALPHANUM].customDestinations-ms~[ALPHANUM].TMP)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Audit Success : Success or failure (access successful)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name
- Access Request Information > Access : Requested privilege
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- EventType : Process type (SetValue)
- Image : Path to the executable file (C:\Windows\Explorer.EXE)
- ProcessGuid/ProcessId : Process ID
- Details : Setting value written to the registry (Binary Data)
- TargetObject : Registry value at the write destination (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\\Count\\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr)
- EventType : Process type (SetValue)
- Image : Path to the executable file (C:Windows\Explorer.EXE)
- ProcessGuid/ProcessId : Process ID
- Details : Setting value written to the registry (QWORD)
- TargetObject : Registry value at the write destination (\REGISTRY\USER\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData\\WindowsPowerShell\v1.0\powershell.exe)
- SourceProcessGUID/SourceProcessId/SourceThreadId : Process of the access source process/Thread ID
- TargetProcessGUID/TargetProcessId : Process ID of the access destination process
- GrantedAccess : Details of the granted access
- SourceImage : Path to the access source process (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- TargetImage : Path to the access destination process (C:\Windows\Explorer.EXE)
- Disabled Privileges : Privileges that were disabled
- Target Account > Security ID/Account Name/Account Domain : Target user SID/Account name/Domain
- Target Account > Logon ID : Session ID of the target user
- Enabled Privileges : Enabled privileges (SeDebugPrivilege)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Process Information > Process ID : ID of the executed process
- Process Information > Process Name : Name of the executed process (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Process > Process ID : ID of the process that used the privilege
- Subject > Logon ID : Session ID of the user who executed the process
- Service Request Information > Privilege : Privilege used (SeCreateGlobalPrivilege)
- Process > Process Name : Process that used the privilege (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].ps1)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].ps1)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].psm1)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].psm1)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].ps1)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege (DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].ps1)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Audit Success : Success or failure (access successful)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name
- Access Request Information > Access : Requested privilege
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege (DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].psm1)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege (DELETE)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\Administrator\AppData\Local\Temp\[RANDOM].psm1)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Audit Success : Success or failure (access successful)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name
- Access Request Information > Access : Requested privilege
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- EventType : Process type (SetValue)
- Image : Path to the executable file (C:Windows\Explorer.EXE)
- ProcessGuid/ProcessId : Process ID
- Details : Setting value written to the registry (Binary Data)
- TargetObject : Registry value at the write destination (\REGISTRY\USER\[SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\\Count\\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\svchost.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privilege
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\svchost.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\svchost.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Message : The content of the script executed. The content of the executed PowerShell script is recorded as is.
- UtcTime : Date and time the change occurred (UTC)
- CreationUtcTime : New timestamp (UTC)
- Image : Path to the executable file
- PreviousCreationUtcTime : Old timestamp (UTC)
- TargetFilename : Name of the file changed
- Connect String : Host name (source host)
- Option Number : Option number for the setting target (34)
- Value : Value set (WSMAN_OPTION_USE_INTEARACTIVE_TOKEN)
- Option Number : Option number for the setting target (26)
- Value : Value set (WSMAN_OPTION_UI_LANGUAGE)
- Option Number : Option number for the setting target (25)
- Value : Value set (WSMAN_OPTION_LOCALE)
- Option Number : Option number for the setting target (1)
- Value : Value set (WSMAN_OPTION_DEFAULT_OPERATION_TIMEOUTMS)
- Option Number : Option number for the setting target (12)
- Value : Value set (WSMAN_OPTION_TIMEOUTMS_CREATE_SHELL)
- Option Number : Option number for the setting target (17)
- Value : Value set (WSMAN_OPTION_TIMEOUTMS_CLOSE_SHELL)
- Option Number : Option number for the setting target (16)
- Value : Value set (WSMAN_OPTION_TIMEOUTMS_SIGNAL_SHELL)
- Option Number : Option number for the setting target (28)
- Value : Value set (WSMAN_OPTION_MAX_ENVELOPE_SIZE_KB)
- Instance ID : Instance ID of the object
- Instance ID : Instance ID of the object
- State : State of the runspace (Opening)
- State : State of the runspace (Opened)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (Domain Controller IP address)
- Image : Path to the executable file (C:\Windows\System32\lsass.exe)
- DestinationHostname : Destination host name (Domain Controller host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (88)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Destination Port : Destination port number (88)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (Domain Controller)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (Domain Controller IP address)
- Image : Path to the executable file (C:\Windows\System32\lsass.exe)
- DestinationHostname : Destination host name (Domain Controller host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (88)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Destination Port : Destination port number (88)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (Domain Controller)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (Domain Controller IP address)
- Image : Path to the executable file (C:\Windows\System32\lsass.exe)
- DestinationHostname : Destination host name (Domain Controller host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (88)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Destination Port : Destination port number (88)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (Domain Controller)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (destination host IP address)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- DestinationHostname : Destination host name (destination host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (5985)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\lsass.exe)
- Network Information > Destination Port : Destination port number (5985)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (destination host)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (destination host IP address)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- DestinationHostname : Destination host name (destination host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (5985)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Destination Port : Destination port number (5985)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (destination host)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (destination host IP address)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- DestinationHostname : Destination host name (destination host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (5985)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Destination Port : Destination port number (5985)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (destination host)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- Protocol : Protocol (tcp)
- DestinationIp : Destination IP address (destination host IP address)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- DestinationHostname : Destination host name (destination host name)
- ProcessGuid/ProcessId : Process ID
- User : Execute as user (NT AUTHORITY\SYSTEM)
- DestinationPort : Destination port number (5985)
- SourcePort : Source port number (high port)
- SourceHostname : Source host name (source host name)
- SourceIp : Source IP address (source host IP address)
- Network Information > Protocol : Protocol used (6=TCP)
- Network Information > Source Port : Bind local port (high port)
- Application Information > Process ID : Process ID
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Destination Port : Destination port number (5985)
- Network Information > Source Port : Source port number (high port)
- Network Information > Destination Address : Destination IP address (destination host)
- Network Information > Protocol : Protocol used (6=TCP)
- Application Information > Application Name : Execution process (\device\harddiskvolume2\windows\system32\windowspowershell\v1.0\powershell.exe)
- Network Information > Direction : Communication direction (outbound)
- Network Information > Source Address : Source IP address (source host)
- Application Information > Process ID : Process ID
- EventType : Process type (CreateKey)
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- ProcessGuid/ProcessId : Process ID
- TargetObject : Created/deleted registry key/value (\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters)
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Type of the file (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle
- Process Information > Process ID : Process ID (hexadecimal)
- Access Request Information > Access/Reason for Access/Access Mask : Requested privileges (including WriteData or AddFile)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Object > Object Name : Target file name (C:\Users\[User Name]\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive)
- Audit Success : Success or failure (access successful)
- Process Information > Process Name : Name of the process that closed the handle (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Object > Object Type : Category of the target (File)
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- Process Information > Process ID : Process ID (hexadecimal)
- Process Information > Process Name : Name of the process that requested the object (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
- Object > Handle ID : ID of the relevant handle (handle obtained with Event ID 4656)
- UtcTime : Process terminated date and time (UTC)
- ProcessGuid/ProcessId : Process ID
- Image : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Process Information > Process ID : Process ID (hexadecimal)
- Subject > Security ID/Account Name/Account Domain : SID/Account name/Domain of the user who executed the tool
- Process Information > Exit Status : Process return value (0xc000013a)
- Subject > Account Name : Name of the account that executed the tool
- Log Date and Time : Process terminated date and time (local time)
- Subject > Account Domain : Domain to which the account belongs
- Process Information > Process Name : Path to the executable file (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
- Subject > Security ID : SID of the user who executed the tool
- Subject > Logon ID : Session ID of the user who executed the process
— UserAssist
# Registry entry Information That Can Be Confirmed 1 HKEY_USERS\[User SID]\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\\Count\\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr Date and time of the initial execution, Total number of executions — MFT
# Path Header Flag Validity 1 [Drive Name]:\Windows\Prefetch\POWERSHELL.EXE-[RANDOM].pf FILE ALLOCATED 2 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations FOLDER ALLOCATED 3 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\[RANDOM].customDestinations-ms FILE ALLOCATED 4 [Drive Name]:\Users\[User Name]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt FILE ALLOCATED — Prefetch
# Prefetch File Process Name Process Path Information That Can Be Confirmed 1 POWERSHELL.EXE-[RANDOM].pf POWERSHELL.EXE \VOLUME\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE Last Run Time (last execution date and time) How to force PowerShell to not allow an interactive command window
I am a Citrix administrator and would like to restrict the general user population on our servers from using PowerShell to run their own scripts, or to use it interactively. We are already disallowing the use of the command prompt via GPO, but with PowerShell available, that’s basically useless. I’ve found that Powershell.exe has a command-line option of -NoInteractive which will allow a user to run a script, but it does not provide them an interactive command prompt. The problem is that I have not found a way to force powershell to operate this way. I even went so far as to create a C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 launch script that would check for the -NoInteractive parameter, but users can bypass that by simply launching Powershell.exe with the -NoProfile parameter. The other problem is that we do use a lot of PowerShell scripts to launch applications for users and portions of the login script are written in PowerShell and need to run under the user context, so I can’t simple ACL the EXE file. I need them to be able to use PowerShell, just not interactively. Ultimately, we want to enforce the AllSigned execution policy and sign all scripts so the only thing a user can run is a script that we (the admins) have created and/or signed off on. I’ve tried googling for this answer and found many people using -NoInteractive , but I haven’t found an instance where someone has tried to force it. Any ideas?
2,318 5 5 gold badges 23 23 silver badges 24 24 bronze badges
asked Nov 7, 2014 at 16:27
SalamanderMN SalamanderMN
81 1 1 gold badge 1 1 silver badge 6 6 bronze badges
I think you already have part of the solution. Signing the scripts and enforcing a policy to prevent unsigned scripts from running sounds like a good plan. You still need to cover interactive use though.