So, let's talk about using PowerShell for security analysis.
So the first thing we've touched on is this log analysis.
Now the Windows Event Log is an essential and
time‑consuming part of a computer forensics,
for example.
The time you spend having to open up the log files,
review everything, deep diving into user logins,
process analysis, regular activity can take quite a long time.
PowerShell provides the ability to quickly
aggregate logs from operating systems, applications,
and other log locations, making it easier to query and inspect.
PowerShell, though often used itself within malware,
can, with some of the extra frameworks and PowerShell add ins,
inspect malware and the effects that are caused by the
malware on the underlying device, hardware,
and operating system.
PowerShell can utilize standard commands to perform network analysis,
like existing third‑party tools, for example.
You can capture network statistics,
as well as capture core traffic for inspection.
Digital forensics benefits a lot from PowerShell because it's
part of nearly all Windows servers and clients,
making it an excellent tool for inspecting at the forensics level.
Using PowerShell you can perform checks within the
environment to identify what took place.
So let's have a good look at an example of retrieving log entries.
Well, we can see here that we're able to specify a type of ID,
so we're using 102, which is the event entry,
and then we use what's called Get‑WinEvent.
We use a FilterHashtable,
which is going to be our kind of properties we're looking for.
You can see I'm using a saved version of the event
log already to make it faster.
And then once we load that and query, we can return the values.
If I wanted to capture network traffic,
then we're going to use a different PowerShell where we use New‑CimSession,
and I'm specifying the computer name, so my Windows 10 device.
I'm then going to create a New‑NetEventSession,
give it a name, and specify the output location.
And obviously the CaptureMode is save to a file.
I'm going to add the types of provider.
In this instance I just want to look for SMBClient traffic.
And then I can simply start the event session.
So in a simplistic way we have built‑in commands that can
help us to perform all of the tasks that you would want to
do as a security analyst.