Chapter 7

1. Public opinion, news, been used in pentesting frameworks.
2. No - comparisons between different scripting languages shows the facts.
3. PowerShell is insecure, PowerShell Remoting is insecure, ExecutionPolicy is a Security Feature, and PowerShell is just PowerShell.exe.
4. Module logging, transcription logging, scriptblock logging.
5. Detection, prevention, and respond a good baseline of all three compartments.
6. Secured by default, using WinRM, by default allowed for administrators group.
7. It controls how PowerShell scripts can be executed as scripts. PowerShell scripts can also be executed as commands, and there are many bypasses available.
8. System.Management.Automation.dll - .NET Framework
9. Extended security features and enforcement capabilities
10. Whitelisting tool
11. If AppLocker is enforced in Allow mode, the interactive shell and every PowerShell script that isn't whitelisted will be executed in ConstrainedLanguageMode.
12. Principle of least privilege, ConstrainedLanguageMode, Logging.