Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1118645" data-attributes="member: 114717">As [USER=32260]@Andy Ful[/USER] points out, if you make the script itself static - which it should be in the first place - then the script itself, when executed by PowerShell, will only modify the hosts file.It is not the script itself that has access, it is the interpreter - PowerShell that accesses, modifies, and executes. If PowerShell can execute scripts then it has full access to most parts of the system.There is no safe way to use PowerShell if you intend not to disable it after you are done using it. Constrained language mode will provide many security benefits, but overall, if your priority is hardened security, then you just don&#039;t allow PowerShell to execute on any system. If it is enabled on a system, particularly in a Windows administrator&#039;s account, and that system is breached, PowerShell is one of the most commonly abused &quot;features&quot; of Windows. It is used as a download cradle, to modify many parts of a system, and to pivot from system to system across a network. It can even encrypt files just like ransomware (PowerShell ransomware). Then it can be used as a reverse malicious agent on a system.There are many aspects to PowerShell security. To cover them all here would take walls of text. Then it would take quite a bit of effort on your part to figure it all out and make it work securely for you. Unless you have the inclination to spend a month or so devoting time and effort to it, the best thing is not to use PowerShell in the first place.The people at Microsoft Security said 10 or 15 years ago they didn&#039;t know what Microsoft was thinking when it developed and shipped PowerShell with Windows. The initial iterations of PowerShell (1.0 and 2.) were extremely insecure. Since then Microsoft has done what it can to make it more secure, but threat actors always find the gaps and holes that Microsoft&#039;s development teams leave within PowerShell that can be exploited.Users HostMan instead:[URL unfurl=&quot;true&quot;]https://www.abelhadigital.com/hostsman/[/URL]</blockquote>

[QUOTE="bazang, post: 1118645, member: 114717"] As [USER=32260]@Andy Ful[/USER] points out, if you make the script itself static - which it should be in the first place - then the script itself, when executed by PowerShell, will only modify the hosts file. It is not the script itself that has access, it is the interpreter - PowerShell that accesses, modifies, and executes. If PowerShell can execute scripts then it has full access to most parts of the system. There is no safe way to use PowerShell if you intend not to disable it after you are done using it. Constrained language mode will provide many security benefits, but overall, if your priority is hardened security, then you just don't allow PowerShell to execute on any system. If it is enabled on a system, particularly in a Windows administrator's account, and that system is breached, PowerShell is one of the most commonly abused "features" of Windows. It is used as a download cradle, to modify many parts of a system, and to pivot from system to system across a network. It can even encrypt files just like ransomware (PowerShell ransomware). Then it can be used as a reverse malicious agent on a system. There are many aspects to PowerShell security. To cover them all here would take walls of text. Then it would take quite a bit of effort on your part to figure it all out and make it work securely for you. Unless you have the inclination to spend a month or so devoting time and effort to it, the best thing is not to use PowerShell in the first place. The people at Microsoft Security said 10 or 15 years ago they didn't know what Microsoft was thinking when it developed and shipped PowerShell with Windows. The initial iterations of PowerShell (1.0 and 2.) were extremely insecure. Since then Microsoft has done what it can to make it more secure, but threat actors always find the gaps and holes that Microsoft's development teams leave within PowerShell that can be exploited. Users HostMan instead: [URL unfurl="true"]https://www.abelhadigital.com/hostsman/[/URL] [/QUOTE]

Verification