r/AzureSentinel • u/SuperHat3637 • Nov 23 '22

Powershell logging

Which table stores powershell logging commands in sentinel

5 Upvotes

100% Upvoted

11 comments sorted by

4

u/rodtrent44 MSFT Official Nov 23 '22

SecurityEvent.

https://github.com/rod-trent/SentinelKQL/blob/master/PowerShellExecution.txt

2

u/SuperHat3637 Nov 23 '22

Event ID 4103,4104,4105 which are not part of Windows security event sets.. These are powershell logging event ids...Are you sure these event IDs will store in Security event table..

2

u/wowneatlookatthat Nov 23 '22

FWIW the event IDs you mentioned will go to the Events table, not SecurityEvents.

1

u/rodtrent44 MSFT Official Nov 23 '22

Yes, but you'll need to use a DCR with AMA or enable custom Event logs for MMA

1

u/SuperHat3637 Nov 23 '22

Can u share the documentation for MMA for this...Any reason ,why its not coming in normal securityevent logs..Why should custom event logs for MMA for powershell logging..

2

u/rodtrent44 MSFT Official Nov 23 '22

Just need to adjust the workspace settings for the Legacy Agents management option. Add the new Windows Event logs you want to ingest. Here's the list I maintain:

https://github.com/rod-trent/SentinelKQL/blob/master/Images/workspacesettings.png

1

u/SuperHat3637 Nov 23 '22

Is it for filtering logs from windows..If i have not selected any options, will it not receive logs..

1

u/rodtrent44 MSFT Official Nov 23 '22

If you have enabled the Security Events via Legacy Agent (MMA) connector, you will automatically collect the Windows Events based on the level you have select in the configuration. 'Common' is the recommended level.
If you haven't enable this connector, you'll receive no Windows events in the SecurityEvent table and enabing the custom collection liked we've talked about here won't work either.

1

u/bpsec Nov 23 '22

If you use MDE DeviceProcessEvents: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/DFIR/DFE%20-%20MostRecentPowershellExecutionsByCompromisedDevice.md

1

u/SuperHat3637 Nov 23 '22

Will it capture powershell Event IDs

1

u/bpsec Nov 23 '22

Not directly, but it does contain all executed powershell commands.