Episode 89 — Audit Windows and Use PowerShell Safely: Telemetry, Basics, and Forensic Readiness

This episode explains Windows auditing and PowerShell safety as two sides of the same operational reality: PowerShell is a legitimate admin tool and a common attacker tool, so visibility and discipline must be built in from the start, which is a frequent GSEC scenario pattern. You’ll learn what useful Windows telemetry looks like for investigations, including authentication events, privilege changes, process and service activity, and script execution evidence, then connect that to how PowerShell can be used for automation, remote administration, and also living-off-the-land attacks. We’ll use scenarios like suspicious remote script execution, encoded command usage, and abnormal administrative activity that blends with normal operations, then focus on best practices such as restricting who can run privileged scripts, using signed scripts where feasible, monitoring high-risk execution patterns, and ensuring logs are centrally collected and retained. Troubleshooting includes determining whether a PowerShell alert is benign automation or malicious activity, validating that audit policies are actually enabled, and ensuring systems are time-synced and configured so event records support reliable timelines. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.