PowerShell Analysis...
 
Notifications
Clear all

PowerShell AnalysisCacheEntry

4 Posts
3 Users
0 Reactions
6,250 Views
(@chris-h)
Posts: 3
New Member
Topic starter
 

Hi,

I found in a timeline that there where several entries in

c/Users/<user>/AppData/Local/Microsoft/Windows/PowerShell/CommandAnalysis/PowerShell_AnalysisCacheEntry_*

Googled around for PowerShell_AnalysisCacheEntry but couldn't find anything meaningful. What does the AnalysisCacheEntry mean? Is that a cache for a PowerShell script run, or a cache for libraries, which are needed by a PowerShell script?

Thanks.

 
Posted : 09/03/2018 1:25 pm
kastajamah
(@kastajamah)
Posts: 113
Estimable Member
 

Have you looked at it in a hex view to see if you can make out anything?

 
Posted : 09/03/2018 4:50 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Check this
https://poshsecurity.com/blog/how-an-issue-with-powershell-dsc-in-wmf-5-cost-us-552695

Seemingly it is a cache storage written to by various operations (WMI/WMF in that reference).

jaclaz

 
Posted : 09/03/2018 4:57 pm
(@chris-h)
Posts: 3
New Member
Topic starter
 

If I took with strings (Linux) I can see some function calls as it seem. E.g.

Add-ADCentralAccessPolicyMember
Add-ADComputerServiceAccount
/Add-ADDomainControllerPasswordReplicationPolicy
&amp;Add-ADFineGrainedPasswordPolicySubject
Add-ADGroupMember
Add-ADPrincipalGroupMembership
Add-ADResourcePropertyListMember
Clear-ADAccountExpiration
Clear-ADClaimTransformLink
Disable-ADAccount !
Disable-ADOptionalFeature $
Enable-ADAccount '
Enable-ADOptionalFeature *
Get-ADAccountAuthorizationGroup -
/Get-ADAccountResultantPasswordReplicationPolicy 0
Get-ADAuthenticationPolicy 3
Get-ADAuthenticationPolicySilo 6
Get-ADCentralAccessPolicy 9
Get-ADCentralAccessRule &lt;
Get-ADClaimTransformPolicy ?
Get-ADClaimType B
Get-ADComputer E
Get-ADComputerServiceAccount H

My question what creates this entries? Is it a PowerShell script, or libs loaded?

 
Posted : 09/03/2018 7:24 pm
Share: