Forum Discussion
retornet
Bronze III
Bronze IIIAPT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance
I need help with Q6. Any hint please The attacker launches a PowerScript useful for reconnaissance activities. What is the full file path of the executed script? I searched (EventCode=4103 OR Eve...
Found it at the end. Thanks
netcat
Silver III
Silver IIIWell, in this case you should narrow down the search, next step:
(EventCode=4103 OR EventCode=4104) powershell .ps1
Narrow down further, removing non relevant scripts:
(EventCode=4103 OR EventCode=4104) powershell .ps1 NOT sample.ps1
