Lesson 3.3: PowerShell: logging, AMSI and downgrade attacks
PowerShell is both an administrator's best tool and a favourite of attackers. Modern Windows PowerShell 5.1 logs every script block it runs (event 4104), even decoded and deobfuscated, and passes content to AMSI so antivirus can block it. Version 2.0 does neither, so attackers who find it installed launch 'powershell -version 2' to slip past both. In the lab you read exported PowerShell logs from the finance workstation: a download cradle caught by AMSI, then a run under the old engine, whose encoded command you decode yourself, and you write the hardening plan.
16 min
You will learn to
- Explain script block logging (4104) and AMSI
- Recognise a PowerShell download cradle
- Detect PowerShell 2.0 downgrades from event 400
- Decode an -EncodedCommand
- Plan PowerShell hardening
Key terms
- Script block logging (4104)
- PowerShell 5+ logs the text of every script block it executes, after deobfuscation.
- AMSI
- Antimalware Scan Interface: lets antivirus inspect scripts and commands at run time.
- Download cradle
- A one-liner that downloads and runs code in memory.
- Downgrade attack
- Using an older, weaker version (PowerShell 2.0) to avoid newer defences.
- -EncodedCommand
- A command passed as base64 of UTF-16LE text.
- Constrained Language Mode
- A PowerShell mode that blocks .NET and COM access, enforced through application control.
← SUID programs and baselines · All lessons · Security headers →