You're reading from PowerShell Automation and Scripting for Cybersecurity

Product type Book

Published in Aug 2023

Publisher Packt

ISBN-13 9781800566378

Pages 572 pages

Edition 1st Edition

Languages

Concepts

Shell Scripting

Author (1):

Miriam C. Wiesner

Table of Contents (19) Chapters

Preface

1. Part 1: PowerShell Fundamentals

2. Chapter 1: Getting Started with PowerShell

3. Chapter 2: PowerShell Scripting Fundamentals

4. Chapter 3: Exploring PowerShell Remote Management Technologies and PowerShell Remoting

5. Chapter 4: Detection – Auditing and Monitoring

6. Part 2: Digging Deeper – Identities, System Access, and Day-to-Day Security Tasks

7. Chapter 5: PowerShell Is Powerful – System and API Access

8. Chapter 6: Active Directory – Attacks and Mitigation

9. Chapter 7: Hacking the Cloud – Exploiting Azure Active Directory/Entra ID

10. Chapter 8: Red Team Tasks and Cookbook

11. Chapter 9: Blue Team Tasks and Cookbook

12. Part 3: Securing PowerShell – Effective Mitigations In Detail

13. Chapter 10: Language Modes and Just Enough Administration (JEA)

14. Chapter 11: AppLocker, Application Control, and Code Signing

15. Chapter 12: Exploring the Antimalware Scan Interface (AMSI)

16. Chapter 13: What Else? – Further Mitigations and Resources

17. Index

Why subscribe?

18. Other Books You May Enjoy

Authentication in AAD

Before we start to dive deeper into what protocols are used and how they work, we first need to understand what a device identity is and how devices are joined.

Device identity – connecting devices to AAD

A device identity is simply the object that will be created in AAD once a device is registered or joined into the AAD tenant. It is similar to a device in on-premises AD and administrators can use it to manage the actual device or to get more information on it. Device identities can be found in the AAD portal under Devices | All devices.

There are three methods for joining or registering devices to AAD:

AAD join: The default method for joining modern devices, such as Windows 10 or Windows 11, to your AAD tenant. Windows Server 2019+ virtual machines (VMs) running in your Azure tenant can be joined as well.
AAD registration: A method to support bring-your-own-device (BYOD) or mobile device scenarios. This method is also considered a...