OK, so in the last lecture we installed since it was simple, seamless and sexy.
OK, maybe not sexy, but it was still fun.
Now we're going to get into power shows, love, great power shows and often abused framework.
I mean, I've heard attackers called the post exploitation framework.
Right.
It's a that framework.
And we'll get into power show later.
We have the entire world and that is its course.
But right now, I just want to show you how we can enable transcription.
This is really important because when this is enabled, we can see each character that the attacker
types.
Right.
That gives a lot look at the exact output that they would see on the screen that sent into our SIM,
our security information and event monitoring platform, which we will be using Splunk for the cyber
age.
But let me show you how to get this set up.
It's really, really cool.
So I'm going to do is I'm going to open up the Web page and we went to Hurricane Lounds Dotcom.
If we scroll down, you can see that there is this partial script, right, so we can click this.
And we're just going to download it.
So let's see here you click raw.
You can basically select the name and then we can go to our show and pull it down.
So let's go to our show.
Control shift enter.
Evoke Webb request.
You are right.
Let's see if this works and see if we can specify.
I don't see an app or directory, but I think I wait.
What's that out for?
Sweet.
So we can put that on our desktop or put it in our.
Yeah, we'll put it in our desktop or downloadable and we'll just name it the same thing.
Partial blogging dot.
P.S. one second work.
Looks like it might have.
There we go, we have it right there, so now we need to run it, right, and how do we do that?
Well, we can simply run the file.
So if we try to run it, that's.
It's going to still run because our execution policy is still set to bypass or unrestricted, right?
All right.
So we're good there.
So now we actually should have power show logging enabled.
We need to do is reboot the box.
And before we do that, though, there's one of the things we need to do.
This is just transcription.
Logging is also another lock me to set up.
So let's go to Ed and I see.
And this is the local group policy, Ed, just want to make sure that we have module logging and also.
Blood enabled.
All right, so we don't so let's start from the top module of this logs, the modules, right, that
are loaded, enable it.
And for show, I'm just going to hit a star here so that we get everything.
OK, this actually tells you what it does, and there's a really, really good article on what Paracha
logging does and what you should enable, you go to a good friends Google.
We can type fire I partial blogging, I believe that's all we need to search for.
Yep.
Greater visibility through a lot.
Yeah, this article is kind of old, you know, when it comes to it in cybersecurity, I don't really
care if I old because it's still a lot of them still have value.
You know, attackers are still using Intermap in mappers.
You know, back when the Matrix came out, trinities using em.
Right.
So, you know, these tools are still effective.
But you can see here, if you read through this document, it tells you, you know, what is module
logging, right.
You know, this is really where the key tells you what a script like log.
And so, you know, this is pretty cool.
It says it also records the office gate code as it executed, right.
So that's really good.
It captures the full contents of code executed by the attacker.
Obviously, they want to see that as a defender.
Right.
And then module logging.
You can read all this, too.
So what we're going to do is really pretty much we're going to follow the instructions here, but.
You know, to save you from having to type everything in here, actually, you can see what we're doing
right here where we're putting that star here to save you from typing everything in here.
And from reading this, we're just going to go and follow it this way.
All right.
So I'm just going to show you I'm going to walk you through it.
So we've got that enabled.
We can hit next setting.
Power shell script, block logging.
Yes, we want that enable.
It looks good.
And we don't want script execution.
And transcription, this should actually already be configured, but we can also label it here as well.
And the reason I said it should already be configured is because we just ran that partial transcription
logging script.
And I like including the invocation headers, because then it shows the timestamps of what the script
was executed.
So I'm going to click, apply and click.
OK, we're looking good here.
We've got the three that the dynamic trio of powerful lights and the just gonna reboot and reboot.
No, it's probably Komala for that.
Now I'm curious.
Let's get come in and we start we start computer.
Look at that.
All right.
So I could say restart computer, but that's going to do it.
Bam, that's how we roll.
And don't worry, again, I'm going to show you power real awesomeness later, you're probably wondering
what the heck was I get a command trick I just ran to or I'm going to demystify the whole thing for
you guys.
This is going to be the ultimate modern hacking, ethical hacking course.
I really want to give you guys everything you need to become, you know, technically adept when it
comes to launching attacks and detecting those attacks.
Right.
That's all we need.
This box is going to reboot our to do its thing.
And right now we are here, it's one thing I want to check to make sure that we are collecting partial
logs.
All right, let's go back into the event viewer.
All right, let's go to Microsoft.
Windows Power Shuttle.
And we do see logs here.
For one, two, three, four, one of four.
And just to test it.
What I can do is I can open up our show.
I can type Pierre's version table and get
it, I get service and then let's go back to the logs and see if we got anything in here.
Click refresh and you can see.
You can Secret Service was launched here.
All right, so that is good in the next election.
We are going to actually dig into Hekker hurricanes, windows, cheat sheets.
So this is the de facto standard when it comes to what you should audit and log in.
So we're almost there.
We're making progress.
But first, we need to set this up.
These these audit policies.
And then once we do that, we can start installing our universal forwarder.
Then we can go to the root of some of the best practices.
Hey, guys, I will see you the next lecture.
It's going to be a lot of fun.
I'll see you guys today by.