Understanding Script Block Logging (Part 3)

by Jun 26, 2018

Categories

Tags

Administration agent-based monitoring Agentless Monitoring alert responses alert thresholds alerting Alerts Amazon Aurora Amazon EC2 Amazon RDS Amazon RDS / Aurora Amazon RDS for SQL Server Amazon Redshift Amazon S3 Amazon Web Services (AWS) Analytics application monitoring Aqua Data Studio automation availability Azure Azure SQL Database azure sql managed instance Azure VM backup Backup and recovery backup and restore backup compression backup status Backup Strategy backups big data Blocking bug fixes business architecture business data objects business intelligence business process modeling business process models capacity planning change management cloud cloud database cloud database monitoring cloud infrastructure cloud migration cloud providers Cloud Readiness Cloud Services cloud storage cloud virtual machine cloud VM clusters code completion collaboration compliance compliance audit compliance audits compliance manager compliance reporting conference configuration connect to database cpu Cross Platform custom counters Custom Views customer survey customer testimonials Dark Theme dashboards data analysis Data Analytics data architect data architecture data breaches Data Collector data governance data lakes data lineage data management data model data modeler data modeling data models data privacy data protection data security data security measures data sources data visualization data warehouse database database administration database administrator database automation database backup database backups database capacity database changes database community database connection database design database developer database developers database development database diversity Database Engine Tuning Advisor database fragmentation database GUI database IDE database indexes database inventory management database locks database management database migration database monitoring database navigation database optimization database performance Database Permissions database platforms database profiling database queries database recovery database replication database restore database schema database security database support database synchronization database tools database transactions database tuning database-as-a-service databases DB Change Manager DB Optimizer DB PowerStudio DB2 DBA DBaaS DBArtisan dBase DBMS DDL Debugging defragmentation Demo diagnostic manager diagnostics dimensional modeling disaster recovery Download drills embedded database Encryption End-user Experience entity-relationship model ER/Studio ER/Studio Data Architect ER/Studio Enterprise Team Edition events execution plans free tools galera cluster GDPR Getting Started Git GitHub Google Cloud Hadoop Healthcare high availability HIPAA Hive hybrid clouds Hyper-V IDERA IDERA ACE Index Analyzer index optimization infrastructure as a service (IaaS) infrastructure monitoring installation Integrated Development Environment interbase Inventory Manager IT infrastructure Java JD Edwards JSON licensing load test load testing logical data model macOS macros managed cloud database managed cloud databases MariaDB memory memorystorage memoryusage metadata metric baselines metric thresholds Microsoft Azure Microsoft Azure SQL Database Microsoft PowerShell Microsoft SQL Server Microsoft Windows MongoDB monitoring Monitoring Tools Monyog multiple platforms MySQL news newsletter NoSQL Notifications odbc optimization Oracle PeopleSoft performance Performance Dashboards performance metrics performance monitoring performance schema performance tuning personally identifiable information physical data model Platform platform as a service (PaaS) PostgreSQL Precise Precise for Databases Precise for Oracle Precise for SQL Server Precise Management Database (PMDB) product updates Project Migration public clouds Query Analyzer query builder query monitor query optimization query performance Query Store query tool query tuning query-level waits Rapid SQL rdbms real time monitoring Real User Monitoring recovery regulations relational databases Releases Reporting Reports repository Restore reverse engineering Roadmap sample SAP Scalability Security Policy Security Practices server monitoring Server performance server-level waits Service Level Agreement SkySQL slow query SNMP snowflake source control SQL SQL Admin Toolset SQL CM SQL code SQL coding SQL Compliance Manager SQL Defrag Manager sql development SQL Diagnostic Manager SQL Diagnostic Manager for MySQL SQL Diagnostic Manager for SQL Server SQL Diagnostic Manager Pro SQL DM SQL Doctor SQL Enterprise Job Manager SQl IM SQL Inventory Manager SQL Management Suite SQL Monitoring SQL Performance SQL Quality SQL query SQL Query Tuner SQL Safe Backup SQL script SQL Secure SQL Security Suite SQL Server sql server alert SQL Server Migration SQL Server Performance SQL Server Recommendations SQL Server Security SQL statement history SQL tuning SQL Virtual Database sqlmemory sqlserver SQLyog Storage Storage Performance structured data Subversion Support tempdb tempdb data temporal data Tips and Tricks troubleshooting universal data models universal mapping unstructured data Uptime Infrastructure Monitor user experience user permissions Virtual Machine (VM) web services webinar What-if analysis WindowsPowerShell

This is part 3 of our mini-series covering PowerShell script block logging. By default, PowerShell logs only code that is considered security relevant. Today, we’ll enable verbose logging. With verbose logging turned on, any PowerShell code executed on your machine by any user will be logged.

To enable verbose mode, you need Administrator privileges. Here is a function that enables verbose logging:

function Enable-VerboseLogging { <# .SYNOPSIS Enables verbose script block logging. Requires Administrator privileges. .DESCRIPTION Turns script block logging on. Any code that is sent to PowerShell will be logged. .EXAMPLE Enable-VerboseLogging Enables script block logging. Administrator privileges required. #> $path = "Registry::HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" $exists = Test-Path -Path $path try { $ErrorActionPreference = 'Stop' if (!$exists) { $null = New-Item -Path $path -Force } Set-ItemProperty -Path $path -Name EnableScriptBlockLogging -Type DWord -Value 1 Set-ItemProperty -Path $path -Name EnableScriptBlockInvocationLogging -Type DWord -Value 1 } catch { Write-Warning "Administrator privileges required. Run this command from an elevated PowerShell." } }

Once you run Enable-VerboseLogging, all PowerShell code will be written to the log. You can then use one of the approaches we introduced earlier to read the logged code, for example our function Get-LoggedCode:

function Get-LoggedCode { # read all raw events  $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 } Get-WinEvent -FilterHashtable $logInfo | # take each raw set of data...  ForEach-Object { # create a new object and extract the interesting  # parts from the raw data to compose a "cooked"  # object with useful data  [PSCustomObject]@{ # when this was logged  Time = $_.TimeCreated # script code that was logged  Code = $_.Properties[2].Value # if code was split into multiple log entries,  # determine current and total part  PartCurrent = $_.Properties[0].Value PartTotal = $_.Properties[1].Value # if total part is 1, code is not fragmented  IsMultiPart = $_.Properties[1].Value -ne 1 # path of script file (this is empty for interactive  # commands)  Path = $_.Properties[4].Value # log level  # by default, only level "Warning" will be logged:  Level = $_.LevelDisplayName # user who executed the code (SID)  User = $_.UserId } } } 

Note that only changes to the logging settings require Administrator privileges. Any user can read the logged data.

If you’d like to disable verbose mode and return to the default settings, use this function:

function Get-LoggedCode { # read all raw events  $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 } Get-WinEvent -FilterHashtable $logInfo | # take each raw set of data...  ForEach-Object { # create a new object and extract the interesting  # parts from the raw data to compose a "cooked"  # object with useful data  [PSCustomObject]@{ # when this was logged  Time = $_.TimeCreated # script code that was logged  Code = $_.Properties[2].Value # if code was split into multiple log entries,  # determine current and total part  PartCurrent = $_.Properties[0].Value PartTotal = $_.Properties[1].Value # if total part is 1, code is not fragmented  IsMultiPart = $_.Properties[1].Value -ne 1 # path of script file (this is empty for interactive  # commands)  Path = $_.Properties[4].Value # log level  # by default, only level "Warning" will be logged:  Level = $_.LevelDisplayName # user who executed the code (SID)  User = $_.UserId } } } 

Note that even when verbose script block logging is turned off, PowerShell will log certain code that is considered security relevant.

Twitter This Tip! ReTweet this Tip!