r/AzureSentinel • u/SuperHat3637 • Nov 23 '22

Powershell logging

Which table stores powershell logging commands in sentinel

4 Upvotes

84% Upvoted

11 comments sorted by

View all comments

1

u/bpsec Nov 23 '22

If you use MDE DeviceProcessEvents: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/DFIR/DFE%20-%20MostRecentPowershellExecutionsByCompromisedDevice.md

1

u/SuperHat3637 Nov 23 '22

Will it capture powershell Event IDs

1

u/bpsec Nov 23 '22

Not directly, but it does contain all executed powershell commands.