Wanted: Process Command Lines
ID: 1fdd3b92-1d63-5b3e-a4f0-365d9f43758d
STIX ID: report--1fdd3b92-1d63-5b3e-a4f0-365d9f43758d
Feed Name: TrustedSec blog
This post details how to enable Windows process creation and command-line auditing (using Group Policy or Sysmon) and how to use the PSGumshoe PowerShell module (Get-EventProcessCreate) to collect and summarize common command-line parameters, with the stated goal of helping red teamers craft process invocations that blend into normal system activity.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.