Skip to content
WindowsHardening

Area 09 / 12

PowerShell Security

PowerShell is the administrator's best tool and the attacker's favourite. Rather than trying to block it, this area makes it transparent and bounded: script block, module and transcription logging, removal of the unlogged PowerShell 2.0 engine, Constrained Language Mode enforced by application control, and Just Enough Administration for delegated tasks.

Start the path

Learning path

0/4 done
  1. 01PowerShell security: logging, v2 removal, CLM and JEAMake PowerShell transparent and bounded: script block, module and transcription logging, removing PowerShell 2.0, Constrained Language Mode enforced by App Control, and Just Enough Administration.
  2. 02Just Enough Administration (JEA) step by stepBuild JEA endpoints that give operators exactly the commands they need: role capability files, session configurations, virtual accounts, gMSAs and auditing.
  3. 03Detecting malicious PowerShell with script block loggingTurn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
  4. 04Hardening WinRM and PowerShell remotingLock down WinRM: inventory listeners, enforce Kerberos, block Basic, Digest and CredSSP, add HTTPS listeners, keep TrustedHosts empty and scope the firewall.