Open mattcargile opened 2 years ago
I too recently ran into this when pulling winlog powershell events and was being triggered by Elastic Security "PowerShell Keylogging Script" alert. After a lot of investigation it was looking like it was a detection rule, and now we can know for sure it's Sentinel One as it's installed or was installed at least on the endpoint in question. Thanks for helping to confirm
Great Info! thanks for contributing.
Very helpful. I was just running through my workstation with Sentinel One. There is surprisingly little information about the pollution Sentinel One is doing to the session. My
ZLocation
performance tanked as well as general performance. The breakpoint on$PSDefaultParameterValues
is probably the worst.I ran through the Script Block logging on my end and see mostly the same code.
Here is the first call I see running. Note: I did remove much of the
encryptedData
I also found it interesting that VSCode running
powershell.exe
was unaffected as ispwsh.exe
.Lastly, it appears they got fancy with there PowerSploit indicators array. This section is a pain because it pollutes the global variable namespace on all sessions with variables
$item
and$local:Po_wer_Spl_oit_Indicators
.