Powershell profiles for non-user accounts

Naveen krishali 1 Reputation point
2021-04-04T07:58:14.04+00:00

Hello ther...
I ran kansa framework on one of my VMs and it reported powershell profiles related to many users. The profiles created for all users are there in their respective Documents folders. But I saw 3 more profiles related to network services, local services and local system. Below are the locations:

Blockquote

Blockquote

Blockquote

Plz explain the relevenace and reason of existence of these profiles. Also, can these profiles be helpful in detecting if any adversary has used powershell for malicious purposes? Also if I have to find all the profiles, what command should I run on the system?

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,355 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andreas Baumgarten 95,496 Reputation points MVP
    2021-04-04T09:10:41.013+00:00

    Hi @Naveen krishali ,

    About PowerShell profiles:
    https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.1

    The presence of a PowerShell profile is not necessarily an indication of anomalies.

    To find all PowerShell profiles on your disk maybe this helps: 

    # Search in drive C:  
Get-Childitem –Path C:\ -Include Microsoft.Powershell_profiles.ps1 -File -Recurse -ErrorAction SilentlyContinue

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten

    0 comments
  2. Ian Xue (Shanghai Wicresoft Co., Ltd.) 29,486 Reputation points Microsoft Vendor
    2021-04-04T12:04:31.06+00:00

    Hi,

    You can find the paths of the PowerShell profiles available in the current session in $PROFILE. 

    $PROFILE | select *

    For the details of the profiles you may refer to the below links
    Understanding the Six PowerShell Profiles
    About Profiles

    Best Regards,
    Ian Xue

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments