Intrusion Analysis Using Windows PowerShell

Microsoft has continually evolved its technology and has introduced some tools that can be used for intrusion analysis. The Windows Advanced Firewall and custom Windows Event Logs are some examples but this paper focuses on a quantum leap forward: PowerShell. Many Analysts must use Windows as their main platform for analysis, and with PowerShell alone, they can perform many of their daily duties. PowerShell is not just an administration language: it can also perform regular expression pattern matching, check the integrity of network monitoring, parse and analyze security events and almost limitless potential other uses. In this paper, we will dive into a few of the many techniques and capabilities of these technologies.