Lion Cipher Lab
Detect malicious PowerShell on your own Windows machine
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
PowerShell is the tool attackers reach for most on Windows, and the reason is uncomfortable: it's already installed, already trusted, and signed by Microsoft, so using it raises no alarms. That's called living-off-the-land — attacking with the software that's already on the box instead of dropping their own malware. The catch for defenders is that on a stock Windows machine, the logging that would record what those PowerShell commands actually did is turned OFF by default. If you wait until an incident to care about it, there's nothing to look at. This lab flips that around: you turn the…
What you'll learn
- enabling PowerShell Script Block Logging (Event ID 4104)
- turning on Module Logging and Transcription
- recognizing living-off-the-land abuse of PowerShell
- hunting encoded and obfuscated PowerShell commands
- reading the Windows event log with Get-WinEvent for DFIR
- mapping observed activity to MITRE ATT&CK T1059.001
Steps in this lab
- Why attackers love PowerShell (living-off-the-land) and ATT&CK T1059.001
- The visibility gap: the logging you need is OFF by default
- Turn ON Script Block Logging (Event ID 4104)
- Turn ON Module Logging and Transcription too (defense in depth)
- The red-flag patterns to hunt for
- Run a BENIGN encoded command yourself
- Find it in the logs with Get-WinEvent
- The reality: log before the incident, and a match is only a lead