What Else? – Further Mitigations and Resources

In this book, we have looked at many topics and techniques that help you mitigate risks in your environment when it comes to PowerShell. But of course, there are many more things that you can do to secure your environment – many directly related to PowerShell, but also others that are not directly related but help you secure PowerShell.

In this chapter, we won’t deep dive into every mitigation; instead, I will provide an overview of what other mitigations exist so that you can explore each on your own. We will cover the following topics:

• Secure scripting
• Exploring Desired State Configuration
• Hardening systems and environment
• Attack detection – Endpoint Detection and Response

Technical requirements

To make the most out of this chapter, ensure that you have the following:

• PowerShell 7.3 and above
• Installed Visual Studio Code
• Access to the GitHub repository for this chapter: https://github.com/PacktPublishing/PowerShell-Automation-and-Scripting-for-Cybersecurity/tree/master/Chapter13

Secure scripting

If you are leveraging self-written scripts in your environment, secure scripting is indispensable. If your scripts can be manipulated, it doesn’t matter (most of the time) what other security mechanisms you have implemented.

Be aware that your scripts can be hacked, and malicious code can be injected. In these cases, you must do the following:

• Always validate input
• Have your code reviewed when developing scripts
• Secure the script’s location and access
• Adopt a secure coding standard, such as the OWASP Secure Coding Practices – Quick Reference Guide: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/

Additionally, two neat PowerShell modules come in handy when developing your own PowerShell scripts that you should know about – PSScriptAnalyzer and InjectionHunter.

PSScriptAnalyzer

PSScriptAnalyzer is a tool that statically checks code for PowerShell scripts and modules. It checks...

Exploring Desired State Configuration

PowerShell Desired State Configuration (DSC) is a feature that enables you to manage your servers using PowerShell configuration as code.

At the time of writing, the following versions of DSC are available that you can use for deployment: DSC 1.1, DSC 2.0, and DSC 3.0.

While DSC 1.1 was included in Windows PowerShell 5.1, in DSC 2.0, which must run DSC on PowerShell 7.2 and above, PSDesiredStateConfiguration is no longer included in the PowerShell package. This enables the DSC creators to develop DSC independently of PowerShell and enables users to upgrade DSC without the need to upgrade PowerShell as well.

DSC 1.1

DSC 1.1 is included in Windows and updated through Windows Management Framework. It runs in Windows PowerShell 5.1. This is the go-to version if Azure Automanage Machine Configuration is not in use.

Remediation

DSC 1.1 has two configuration modes:

• Push: The configuration is pushed manually
• Pull: The nodes...

Hardening systems and environments

In the end, you can harden PowerShell as much as you like; if the systems on which PowerShell is running are not protected, adversaries will make use of that if they have the chance. Therefore, it is important to also look at how you can harden the security of your infrastructure.

Security baselines

A great start to hardening your Windows systems – regardless of the server, domain controller, or client – are the so-called security baselines provided by Microsoft. These security baselines are part of Microsoft’s Security Compliance Toolkit (SCT) 1.0, which can be downloaded from here: https://www.microsoft.com/en-us/download/details.aspx?id=55319.

Please be careful when applying security baselines!

You should never just apply a security baseline to a running production system. Before applying it, carefully audit your settings and evaluate them. Then, work on a plan to enroll your changes. Many settings are included...

Attack detection – Endpoint Detection and Response

Another really important point is to have a product in place to detect attacks and react to them. There are many great products out there that can help you with this task. Make sure that the product of your choice also supports PowerShell and helps you detect suspicious commands that were launched via PowerShell and other command-line tools.

Microsoft’s solution, for example, is called Microsoft Defender for Endpoint. But other vendors provide similar solutions.

Enabling free features from Microsoft Defender for Endpoint

Even if you do not use Microsoft Defender for Endpoint, various features are free to use without any subscription:

• Hardware-based isolation/Application Guard
• Attack surface reduction rules
• Controlled folder access
• Removable storage protection
• Network protection
• Exploit Guard
• Windows Defender Firewall with advanced security

Many of these features can even...

Summary

This chapter sums up this book on PowerShell security. It was not meant to provide deep technical information, but rather an outlook of what else can be done to improve the security of your network. With this, you have a good overview of what to do next and what to look up.

You got some insights into secure scripting and what tools you can use to improve your scripting security. You also learned what DSC is and how to get started. And last but not least, you also got insights into hardening your systems.

I hope you enjoyed this book and could make the most of it. Happy scripting!

Further reading

If you want to explore some of the topics that were mentioned in this chapter, take a look at these resources:

LAPS

• LAPS: https://www.microsoft.com/en-us/download/details.aspx?id=46899

PSScriptAnalyzer

• PSScriptAnalyzer on GitHub: https://github.com/PowerShell/PSScriptAnalyzer
• PSScriptAnalyzer reference: https://learn.microsoft.com/en-us/powershell/module/psscriptanalyzer/?view=ps-modules
• PSScriptAnalyzer module overview: https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/overview?view=ps-modules

Security baselines and SCT

• Microsoft SCT 1.0 – How to use it: https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10
• LGPO.exe – Local Group Policy Object Utility, v1.0: https://techcommunity.microsoft.com/t5/microsoft-security-baselines/lgpo-exe-local-group-policy-object-utility...

The rest of the chapter is locked

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Renews at €14.99/month. Cancel anytime

Start free trial

Previous Chapter

Chapter 17 of 19

Next Chapter

Exploring Desired State Configuration

PowerShell Desired State Configuration (DSC) is a feature that enables you to manage your servers using PowerShell configuration as code.

At the time of writing, the following versions of DSC are available that you can use for deployment: DSC 1.1, DSC 2.0, and DSC 3.0.

While DSC 1.1 was included in Windows PowerShell 5.1, in DSC 2.0, which must run DSC on PowerShell 7.2 and above, PSDesiredStateConfiguration is no longer included in the PowerShell package. This enables the DSC creators to develop DSC independently of PowerShell and enables users to upgrade DSC without the need to upgrade PowerShell as well.

DSC 1.1

DSC 1.1 is included in Windows and updated through Windows Management Framework. It runs in Windows PowerShell 5.1. This is the go-to version if Azure Automanage Machine Configuration is not in use.

Remediation

DSC 1.1 has two configuration modes:

• Push: The configuration is pushed manually
• Pull: The nodes...

Hardening systems and environments

In the end, you can harden PowerShell as much as you like; if the systems on which PowerShell is running are not protected, adversaries will make use of that if they have the chance. Therefore, it is important to also look at how you can harden the security of your infrastructure.

Security baselines

A great start to hardening your Windows systems – regardless of the server, domain controller, or client – are the so-called security baselines provided by Microsoft. These security baselines are part of Microsoft’s Security Compliance Toolkit (SCT) 1.0, which can be downloaded from here: https://www.microsoft.com/en-us/download/details.aspx?id=55319.

Please be careful when applying security baselines!

You should never just apply a security baseline to a running production system. Before applying it, carefully audit your settings and evaluate them. Then, work on a plan to enroll your changes. Many settings are included...

Attack detection – Endpoint Detection and Response

Another really important point is to have a product in place to detect attacks and react to them. There are many great products out there that can help you with this task. Make sure that the product of your choice also supports PowerShell and helps you detect suspicious commands that were launched via PowerShell and other command-line tools.

Microsoft’s solution, for example, is called Microsoft Defender for Endpoint. But other vendors provide similar solutions.

Enabling free features from Microsoft Defender for Endpoint

Even if you do not use Microsoft Defender for Endpoint, various features are free to use without any subscription:

• Hardware-based isolation/Application Guard
• Attack surface reduction rules
• Controlled folder access
• Removable storage protection
• Network protection
• Exploit Guard
• Windows Defender Firewall with advanced security

Many of these features can even...

Summary

This chapter sums up this book on PowerShell security. It was not meant to provide deep technical information, but rather an outlook of what else can be done to improve the security of your network. With this, you have a good overview of what to do next and what to look up.

You got some insights into secure scripting and what tools you can use to improve your scripting security. You also learned what DSC is and how to get started. And last but not least, you also got insights into hardening your systems.

I hope you enjoyed this book and could make the most of it. Happy scripting!

Further reading

If you want to explore some of the topics that were mentioned in this chapter, take a look at these resources:

LAPS

• LAPS: https://www.microsoft.com/en-us/download/details.aspx?id=46899

PSScriptAnalyzer

• PSScriptAnalyzer on GitHub: https://github.com/PowerShell/PSScriptAnalyzer
• PSScriptAnalyzer reference: https://learn.microsoft.com/en-us/powershell/module/psscriptanalyzer/?view=ps-modules
• PSScriptAnalyzer module overview: https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/overview?view=ps-modules

Security baselines and SCT

• Microsoft SCT 1.0 – How to use it: https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10
• LGPO.exe – Local Group Policy Object Utility, v1.0: https://techcommunity.microsoft.com/t5/microsoft-security-baselines/lgpo-exe-local-group-policy-object-utility...

The rest of the chapter is locked