PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Guides tagged
#powershell
PowerShell Security
Just Enough Administration (JEA) step by step
Build JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing.
Advanced
PowerShell Security
Hardening WinRM and PowerShell remoting
Lock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.
Intermediate
PowerShell Security
PowerShell security: logging, v2 removal, CLM and JEA
Make PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
Intermediate