PowerShell Transcripts & Logging

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" 2>nul

C:\Users\<user>\Documents\PowerShell_transcript*.txt
C:\Transcripts\
C:\Windows\Temp\

Get-ChildItem -Path C:\ -Recurse -Include "PowerShell_transcript*" -ErrorAction SilentlyContinue

dir /s /b C:\*transcript*.txt 2>nul

Get-ChildItem -Path C:\ -Recurse -Include "PowerShell_transcript*" -ErrorAction SilentlyContinue | ForEach-Object { Select-String -Path $_ -Pattern "password|credential|secret|key|ConvertTo-SecureString" }

(Get-PSReadlineOption).HistorySavePath

C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Output "=== $($_.FullName) ==="
    Get-Content $_
}

Get-ChildItem -Path C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | ForEach-Object {
    Select-String -Path $_ -Pattern "password|ConvertTo-SecureString|PSCredential|net user|runas" -AllMatches
}

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" 2>nul

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 100 | Where-Object { $_.Message -match "password|credential" }

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" 2>nul

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath '*[System[EventID=4104]]' -MaxEvents 100 | ForEach-Object { $_.Message }

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -FilterXPath '*[System[EventID=4104]]' -MaxEvents 500 | Where-Object { $_.Message -match "password|secret|credential|ConvertTo-SecureString" } | ForEach-Object { $_.Message }

$pass = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("admin", $pass)

Get-ChildItem -Path C:\ -Recurse -Include *.ps1,*.psm1,*.psd1 -ErrorAction SilentlyContinue | Select-String -Pattern "ConvertTo-SecureString|PSCredential|password" -List

$secstr = ConvertTo-SecureString "encrypted_string_here"
$cred = New-Object System.Management.Automation.PSCredential("user", $secstr)
$cred.GetNetworkCredential().Password

$secstr = Get-Content C:\Users\admin\cred.txt | ConvertTo-SecureString
[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secstr))