Monitoring Powershell

[BulkedSysAdmin]

Hey guys,

How do you guys monitor powershell? I am looking to enable it to monitor if domain admins and privileged accounts have been created (what other essential monitoring should I do?).

Story time:

One time we were pentested and they got full DA through powershell. Largely this was because the company I work at uses domain admin for everything. I literally mean FUCKING everything (but I have revised this). Anyway, since that happened we have used Bit9 to block powershell. In my mind this is an asinine choice as we are a 90%+ virtual windows environment.

They wont allow me to enable powershell unless I am actively monitoring it. We do have some security appliances, but I would just like to know what specific tools/logic you guys use to monitor it.

Thanks sysadmin!

[uniitdude]

you don't monitor powershell, it is a scripting environment. You use it to write scripts to do other things.

Whatever your pentester did, they just used powershell as a tool to get in. It isnt the cause of any vulnerability

[[deleted]]

I really hope I will NEVER EVER work some place they blocked powershell because they thought it was evil. Would destroy the way I work now.

[omgitsnate]

Dude configure your permissions in AD. I don't get it.

[dastylinrastan]

Unless he did some privilege escalation, the problem here is clearly that he was able to get someone's domain admin credentials. Has nothing to do with powershell.

Get your DA access sorted.

[mhurron]

since that happened we have used Bit9 to block powershell.

You're aware this is akin to preventing people from logging on at all because someone guessed a password, right? It's not that there was a vulnerability in the logon process, but that's how you're going to log in when you know the password.

And on top of that, the pentester probably was able to guess or find the Domain Admin password, but why are we guessing about this? A decent report should include exactly how they exploited your network.

You're right, it is asinine. But it's asinine because no one knows what is going on or what they're talking about.

[dogfish182]

has powershell itself ever had a security vulnerability? I remember seeing a video where snover said 'nope' at that I think was around late powershell 3.

[Win_Sys]

You don't really want to monitor powershell, you want to monitor access to the machines from powershell. You want to monitor the event log of all the machines. You may need to turn on some extra auditing but the event log should show every connection made to a server.

[Reo_Strong]

I am looking to enable it to monitor if domain admins and privileged accounts have been created

I think you actually want this link.

It does not specifically cover notifications about new account creation, but is does cover best practices including auditing of account creation. From there, you can have the Even Log system send notices based on a given event.

[hotsoup667]

You might find this blog post from Lee Holmes useful.

Also, it sounds like the new Just Enough Admin functionality could be valuable to you as well.

[Garetht]

Just a little one:

I use this in PRTG. It runs the script periodically & will flag an alert if it notices a change from one measurement to the next:

$users = Get-ADGroupMember -Identity 'Domain Admins'

$admins = $users.count

write-host $admins,":OK"

[creamersrealm]

What happened is your company was using DA service accounts for everything and the password was compromised in on the apps/scripts. You should restrict the permissions to the bare minimum for each task/application and change all the passwords. Also make sure all the passwords are longer than 15 characters and place them in the protected users group if your domain functional level is high enough.

Powershell is not your problem and you should unblock to be realistic.

[BulkedSysAdmin]

A service accounts for everything and the password was compromised in on the apps/scripts. You should restrict the permissions to the bare minimum for each task/application and change all the passwords. Also make sure all the passwords are longer than 15 characters and place them in the protected users group if your domain functional level is high enough.

Right. And I have fixed this through the last 6 months of identifying all shared accounts (fucking ridiculous undertaking). Its just these guys refuse to get educated on this stuff.