Does your organization allow users to run PowerShell on Microsoft Windows?
- Yes
- No
- Are you kidding? We use Mac's!
Why do I ask? State Actors use the scripting language heavily in cyberattacks. One example is with the Petya/NotPetya campaigns. The problem is that PowerShell has native integration with .NET Framework which offers:
- Simple access to network sockets
- Easy access to crypto libraries
- Ability to hook managed code
- Ability to assemble malicious binaries dynamically in memory
- Direct access to the Win32 Application Programming Interface
- Simple interface with Windows Management Instrumentation
- Dynamic, runtime method calls
The most effective way (according to Microsoft) to block PowerShell is to block the System.Management.Automation.dll, which is the library that PowerShell heavily relies on. For more on the risks check out an article here and a video here.
