A county Windows host shows PowerShell history and transcription logs that appear to capture prior admin commands. What is the best privilege-escalation enumeration takeaway?
Select an answer to reveal the explanation.
Short Explanation
Admins sometimes type secrets the same way people leave sticky notes on monitors. History and transcripts are those sticky notes in digital form—great for understanding what ran and sometimes what was typed.
Full Explanation
On Windows, PowerShell history, transcription, and related logging artifacts can expose commands, credentials, and infrastructure details used by administrators. Authorized local enumeration should include careful review of these artifacts because they often accelerate privilege escalation or lateral planning without needing destructive techniques. Findings should stress secure admin practices: avoid plaintext secrets in interactive shells, protect transcript locations, and rotate exposed credentials. This is credential and intel enumeration, not a requirement to invent new malware.