Introducing PowerShell security
PowerShell has become one of the most popular tools in the sysadmin's toolbox in recent years. Its uses range from the ability to batch processes and build tools to automating repeatable tasks. There are many importable modules that allow interaction with a range of services such as Azure AD and Exchange Online. As a result, PowerShell can be exploited as an attack tool due to this flexibility. It has close interaction with various OS system-level components, such as Windows Management Instrumentation (WMI), and can avoid detection as it's a commonly used process. Out of the box, there are limited security measures enabled for PowerShell, so let's discuss what we can do to help secure its use.
Configuring PowerShell logging
There are a few types of logging that can be enabled for PowerShell to start logging events for auditing purposes. Some of the logging options include the following:
- PowerShell Transcription allows Windows...
