Search for suspicious content in PowerShell transcripts

find_sus_powershell.ps1

# Based on logic found here: https://gist.github.com/ecapuano/1c6bd492707114a052915e85f443a832
# Assumes default path for Transcripts (change as needed)
#
# https://blog.ecapuano.com

# 1) Discover transcript files
$transcripts = Get-ChildItem -Path C:\Users -Filter 'PowerShell_transcript*.txt' `
  -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName

# 2) Curated patterns
$patterns = @(
  'Invoke-WebRequest','DownloadString','IEX','FromBase64String',
  'Add-MpPreference','Set-MpPreference','schtasks','bitsadmin','wevtutil',
  'reg add','netsh','rundll32','adscredentials','mimikatz','PowerView',

  '-enc','-encodedcommand','-nop','-noni','-noninteractive',
  '-w hidden','-win hidden','-windowstyle hidden',
  '-ep bypass','-executionpolicy bypass',

  'DisableRealtimeMonitoring','DisableBehaviorMonitoring','DisableArchiveScanning',
  'DisableScriptScanning','DisableIOAVProtection','MAPSReporting','SubmitSample',

  'PowerSploit','Nishang','samratashok','DownloadFile','EncodedCommand',
  'TVqQAAMAAAAEAAAA', # base64 PE header marker
  'Shellcode'
)

if ($transcripts) {
  Select-String -Path $transcripts -Pattern $patterns -SimpleMatch |
    Sort-Object Filename, LineNumber |
    Select-Object Filename, LineNumber, Line
}