Defending against PowerShell attacks

In the previous sections, we went through various techniques for attacking machines using Metasploit and PowerShell. Now it is time to learn how to defend against and mitigate PowerShell attacks. In order to protect against PowerShell attacks, you need to:

1. Implement the latest PowerShell version (version 5, when this book was written). To check, type Get-Host:

2. Monitor PowerShell logs.

3. Ensure a least-privilege policy and group policies settings. You can edit them with the Local Group Policy Editor. If you are using the Windows 10 Enterprise edition, you can also use AppLocker:

4. Use the Constrained Language mode:

PS C:\Windows\system32> [environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

5. To check the Constrained Language mode, type:

 $ExecutionContext.SessionState.LanguageMode...