July 17, 2022, 3:29 p.m. | /u/EnormousJohnson

Computer Forensics www.reddit.com

When running a PowerShell command or a ps1 script, what forensic evidence is left behind? I know of the event logs and general PowerShell history.

Is there any where else that can be investigated to see if PowerShell commands have been executed? or any particular arftifects to look for?

Still new to windows forensics, thanks in advance :)

command computerforensics forensics history powershell windows windows forensics

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Security Officer Hospital - Major Hospital Account - Full-Time - Healthcare Security

@ Allied Universal | Anaheim, CA, United States

Product Security Lead

@ Lely | Maassluis, Netherlands

Summer Associate, IT Information Security (Temporary)

@ Vir Biotechnology, Inc. | San Francisco, California, United States

Director, Governance, Risk and Compliance - Corporate

@ Ryan Specialty | Chicago, IL, US, 60606

Cybersecurity Governance, Risk, and Compliance Engineer

@ Emerson | Shakopee, MN, United States