How to log and monitor PowerShell activity for suspicious scripts and commands

How to log and monitor PowerShell activity for suspicious scripts and commands

Consultants are often jacks of all trades, hired by multiple businesses — sometimes simultaneously — to solve problems before moving on to the next engagement. This makes them prime targets for attackers. Gain a toehold on a consultant’s desktop and you can gain access potentially to multiple businesses the consultant works for. Take a recent attack sequence as an example: A consultant was at home relaxing when his computer indicated there was a…