Blog Post

Microsoft Sentinel Blog
7 MIN READ

The power of Data Collection Rules: Monitoring PowerShell usage

miriamwiesner's avatar
miriamwiesner
Icon for Microsoft rankMicrosoft
Sep 16, 2024
This is Part 2 of our Blog series on how to collect events using DCRs for advanced use cases. For Part 1, please check The power of Data Collection Rules: Collecting events for advanced use cases in ...
Updated Sep 17, 2024
Version 2.0
ZaferBalkan's avatar
ZaferBalkan
Brass Contributor
Oct 12, 2024

Hi Miriam, 

 

Is it possible for any time in the future PowerShell 5 and 7 can have a separate event log that is initially the same with existing command and script logging, but triggered by engine if the command is base64 encoded? Therefore, the log would consist of the decoded command and we can understand the difference by the event ID. That'd help detections smoother.