The installation is quite involved and the majority of it is handled via the terminal. So log into your Ubuntu 16.04 server and prepare to type. Configuring apt and update/upgrade ...

Once logging is enabled, look for event 4104 in the event logs. Also set up logging for Module Logging. Both settings will ensure you can monitor for suspicious scripts.