Threat Advisory

NSA shares tips on securing windows devices with PowerShell

Threat: Vulnerability
Criticality: High

Summary:

The National Security Agency (NSA) and cybersecurity partner agencies issued an advisory today recommending system administrators to use PowerShell to prevent and detect malicious activity on Windows machines. PowerShell is frequently used in cyberattacks, leveraged mostly in the post-exploitation stage, but the security capabilities embedded in Microsoft’s automation and configuration tool can also benefit defenders in their forensics efforts, improve incident response, and to automate repetitive tasks.

Description:

The NSA and cyber security centres have created a set of recommendations for using PowerShell to mitigate cyber threats instead of removing or disabling it, which would lower defensive capabilities. Blocking PowerShell hinders defensive capabilities that current versions of PowerShell can provide and prevent components of the windows operating system from running properly. Recent version of PowerShell with improved capabilities and options can assist defenders in countering abuse of PowerShell. Proper configuration of WDAC or AppLocker on windows 10+ helps to prevent a malicious actor from gaining full control over a PowerShell session and the host.

Security features present in PowerShell versions

Best Practices:

  • Recording PowerShell activity and monitoring the logs are two recommendations that could help administrators find signs of potential abuse.
  • Turning on features like Deep Script Block Logging (DSBL), Module Logging, and Over-the-Shoulder transcription (OTS).
  • Customizing Windows Firewall to allow connections only from trusted endpoints and networks helps reduce an attacker’s chance for successful lateral movement.

Threat Assessment:

PowerShell is essential to secure the Windows operating system, particularly the newer versions that dealt away with previous limitations. When properly configured and managed, PowerShell can be a reliable tool for system maintenance, forensics, automation, and security.

crossmenu