Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 771017">PoSh = versions 1 thru 5. 6 is in beta right now.PoSh v2.0 has weak protections because Microsoft didn&#039;t develop it with security in mind in the first place.PoSh v3 - 5, Microsoft has serviced because of numerous reports of security problems. Microsoft has done a bare minimum job at improving security. Of course the whole point is to make PoSh available, but make it safe. That is an oxymoron - unless Microsoft collects it all to know it all and then patches it all. The face of stupidity.PoSh v2.0 stupidly remains installed on Windows by default for backwards compatibility\legacy reasons.PoSh code\commandlets are not universal across all versions of PoSh. So a cmdlet on v5.0 cannot automatically be used in v2.0.However, v2.0 can be used maliciously if it is installed and active on Windows.PoSh Constrained Language Mode (v5.0) or _pspolicy as an environmental variable are good security. However, v2.0 and other methods can be used to disable Constrained Language Mode. Therefore, just uninstall v2.0.Disabling PoSh and wscript makes missing ASR rules in Exploit Guard a moot point.Microsoft Windows spaghetti security.</blockquote>

[QUOTE="509322, post: 771017"] PoSh = versions 1 thru 5. 6 is in beta right now. PoSh v2.0 has weak protections because Microsoft didn't develop it with security in mind in the first place. PoSh v3 - 5, Microsoft has serviced because of numerous reports of security problems. Microsoft has done a bare minimum job at improving security. Of course the whole point is to make PoSh available, but make it safe. That is an oxymoron - unless Microsoft collects it all to know it all and then patches it all. The face of stupidity. PoSh v2.0 stupidly remains installed on Windows by default for backwards compatibility\legacy reasons. PoSh code\commandlets are not universal across all versions of PoSh. So a cmdlet on v5.0 cannot automatically be used in v2.0. However, v2.0 can be used maliciously if it is installed and active on Windows. PoSh Constrained Language Mode (v5.0) or _pspolicy as an environmental variable are good security. However, v2.0 and other methods can be used to disable Constrained Language Mode. Therefore, just uninstall v2.0. Disabling PoSh and wscript makes missing ASR rules in Exploit Guard a moot point. Microsoft Windows spaghetti security. [/QUOTE]

Verification