CMD
Batch script. Highly limited in functionality and caching all sorts of crap, including credentials.
PowerShell
Anatomy
Authentication cons:
- Traffic is encrypted
- Kerberos is used for authentication
- Credentials are not cached on the remote system (not AS).
PowerShell gives you the power of WMI, .NET and COM at once. It provides a unified interface to interact with data types such as the registry, file volumes, Active Directory etc.
❗️The output of most of the ps commands are not strings but objects that can be piped into other commands.
PowerShell has short commands. For example, Get-Command cmdlet can be shortened to gcm. Used along with wildcards, one can obfuscate a script a little: gcm 'i*e-e*' gets the list of commands satisfying this expression, which is only one: Invoke-Expression.
📚 Further reading: https://devblogs.microsoft.com/scripting/weekend-scripter-using-powershell-to-aid-in-security-forensics/, https://www.ldap389.info/en/2013/06/17/powershell-forensic-onliners-regex-get-eventlog/, https://devblogs.microsoft.com/scripting/use-powershell-to-perform-offline-analysis-of-security-logs/, https://devblogs.microsoft.com/scripting/learn-the-easy-way-to-use-powershell-to-get-file-hashes/, https://devblogs.microsoft.com/scripting/use-powershell-to-compute-md5-hashes-and-find-changed-files/.
Remote
WinRM - Windows remote service for remote management. It is turned on by default on Windows Servers 2012+. The transfer protocol used is WSMAN (SOAP, HTTP and XML). Credentials are NOT cached on the remote system, which is good.
You may start a session on a remote system using Enter-PSSession (similar to SSH, but uses Kerberos for authentication).
When dealing with a large number of machines, retrieving data from each one of them using a WMI command can be time-consuming. A better option is to use Invoke-Command, which enables concurrent execution on multiple machines and moves the computation to the remote system. -AsJob option can also be used to move the process to the background if it takes too long to finish.
Logs
Windows PowerShell Event logs Operational Monitoring: %SystemRoot%\System32\winevt\Logs\Microsoft-Windows-Powershell%Operational.evtx, ID 4103, 4104 (if Windows considers it suspicious).
%SystemRoot%\System32\winevt\Logs\Microsoft-Windows-Powershell.evtx. ID 400, 800.
%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost - PowerShell history.