Bronze III need help with Q6. Any hint please
The attacker launches a PowerScript useful for reconnaissance activities. What is the full file path of the executed script?
I searched (EventCode=4103 OR EventCode=4104) combined with powershell.
Silver IIWell, in this case you should narrow down the search, next step:
(EventCode=4103 OR EventCode=4104) powershell .ps1
Narrow down further, removing non relevant scripts:
(EventCode=4103 OR EventCode=4104) powershell .ps1 NOT sample.ps1
Bronze IIThank you for your reply. I ran it like below and still having difficulties finding that script
(EventCode=4103 OR EventCode=4104) powershell AND "*.ps1" NOT ("psversion.ps1" OR "readme.ps1")
| table _raw
