You're reading from PowerShell Automation and Scripting for Cybersecurity

Product type Book

Published in Aug 2023

Publisher Packt

ISBN-13 9781800566378

Pages 572 pages

Edition 1st Edition

Languages

Concepts

Shell Scripting

Author (1):

Miriam C. Wiesner

Table of Contents (19) Chapters

Preface

1. Part 1: PowerShell Fundamentals

2. Chapter 1: Getting Started with PowerShell

3. Chapter 2: PowerShell Scripting Fundamentals

4. Chapter 3: Exploring PowerShell Remote Management Technologies and PowerShell Remoting

5. Chapter 4: Detection – Auditing and Monitoring

6. Part 2: Digging Deeper – Identities, System Access, and Day-to-Day Security Tasks

7. Chapter 5: PowerShell Is Powerful – System and API Access

8. Chapter 6: Active Directory – Attacks and Mitigation

9. Chapter 7: Hacking the Cloud – Exploiting Azure Active Directory/Entra ID

10. Chapter 8: Red Team Tasks and Cookbook

11. Chapter 9: Blue Team Tasks and Cookbook

12. Part 3: Securing PowerShell – Effective Mitigations In Detail

13. Chapter 10: Language Modes and Just Enough Administration (JEA)

14. Chapter 11: AppLocker, Application Control, and Code Signing

15. Chapter 12: Exploring the Antimalware Scan Interface (AMSI)

16. Chapter 13: What Else? – Further Mitigations and Resources

17. Index

Why subscribe?

18. Other Books You May Enjoy

Access rights

Access control can be configured to allow one or multiple users access to a certain resource. Depending on what can be done with each level of access, configuring and maintaining access right configurations is highly sensitive.

Also, in AD, resources are restricted using access control. In this section, let’s have a look at the basics and how to audit access.

What is a SID?

A SID is a unique ID of an account and the primary identifier. It does not change for the lifetime of an account. This allows the concept of renaming users without causing any access or security issues.

There are some well-known SIDs available in every environment – the only difference is the domain ID, which was added to the beginning of the SID.

For example, the well-known SID of the built-in domain administrator follows this schema: S-1-5-21-<domain>-500.

The last number group represents the user number: in this case, 500 is a reserved, well-known SID. Well...