question

Naveenkrishali-0183 avatar image
0 Votes"
Naveenkrishali-0183 asked AndreasBaumgarten commented

Powershell profiles for non-user accounts

Hello ther...
I ran kansa framework on one of my VMs and it reported powershell profiles related to many users. The profiles created for all users are there in their respective Documents folders. But I saw 3 more profiles related to network services, local services and local system. Below are the locations:

Blockquote


Blockquote


Blockquote



Plz explain the relevenace and reason of existence of these profiles. Also, can these profiles be helpful in detecting if any adversary has used powershell for malicious purposes? Also if I have to find all the profiles, what command should I run on the system?

windows-server-powershell
image.png (4.6 KiB)
image.png (4.4 KiB)
image.png (4.6 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @Naveenkrishali-0183 ,

Did the answer work for you? Are there any additional questions to this topic?

If you found the answer helpful, it would be great if you please mark it "Accept as answer". This will help others to find answers in Q&A

----------
Regards
Andreas Baumgarten

0 Votes 0 ·
AndreasBaumgarten avatar image
0 Votes"
AndreasBaumgarten answered

Hi @Naveenkrishali-0183 ,

About PowerShell profiles:
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.1

The presence of a PowerShell profile is not necessarily an indication of anomalies.

To find all PowerShell profiles on your disk maybe this helps:

 # Search in drive C:
 Get-Childitem –Path C:\ -Include Microsoft.Powershell_profiles.ps1 -File -Recurse -ErrorAction SilentlyContinue


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

IanXue-MSFT avatar image
0 Votes"
IanXue-MSFT answered IanXue-MSFT edited

Hi,

You can find the paths of the PowerShell profiles available in the current session in $PROFILE.

 $PROFILE | select *

For the details of the profiles you may refer to the below links
Understanding the Six PowerShell Profiles
About Profiles

Best Regards,
Ian Xue
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.