Tweet
Task automation platform PowerShell, which is often abused by threat actors distributing malware, can also be used for attack detection and prevention. This is the advice the US National Security Agency (NSA) recently gave to system administrators everywhere.
Alongside cybersecurity centers in the UK and New Zealand, the NSA published a security advisory in which it argues that blocking PowerShell, a common security practice, actually lowers organizationsā defensive capabilities against ransomware and other forms of cyberattacks.
Instead, system admins should use it to boost their forensics and incident response, as well as to automate as many repetitive tasks as possible.
https://cdn.mos.cms.futurecdn.net/ybbmQ8p4Q999AkMWkW8HLm.jpg
Share your thoughts on Cybersecurity and get a free copy of the Hackerās Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/Ā£10.99.
[HEADING=1]Numerous recommendations[/HEADING]
āBlocking PowerShell hinders defensive capabilities that current versions of PowerShell can provide, and prevents components of the Windows operating system from running properly. Recent versions of PowerShell with improved capabilities and options can assist defenders in countering abuse of PowerShell,ā the NSA stated.
The advisory comes with a number of recommendations, including leveraging PowerShell remoting, or using Secure Shell protocol (SSH) to improve the security of public-key authentication.
āProper configuration of WDAC or AppLocker on Windows 10+ helps to prevent a malicious actor from gaining full control over a PowerShell session and the host,ā the document explained.
System admins can also hunt for signs of abuse on their endpoints by recording PowerShell activity and monitoring logs.
Read more
The advisory also recommends admins turn on features such as Deep Script Block Logging, Module Logging, or Over-The-Shoulder Transcription, as the former create a log database, handy for spotting aggressive PowerShell activity.
The latter allows admins to record every PowerShell input and output, getting a better understanding of the attackersā goals.
āPowerShell is essential to secure the Windows operating system,ā the NSA concluded, adding that, with proper configuration and management, it can be a great tool for system maintenance and security.
Via BleepingComputer
Continue readingā¦
Alongside cybersecurity centers in the UK and New Zealand, the NSA published a security advisory in which it argues that blocking PowerShell, a common security practice, actually lowers organizationsā defensive capabilities against ransomware and other forms of cyberattacks.
Instead, system admins should use it to boost their forensics and incident response, as well as to automate as many repetitive tasks as possible.
https://cdn.mos.cms.futurecdn.net/ybbmQ8p4Q999AkMWkW8HLm.jpg
Share your thoughts on Cybersecurity and get a free copy of the Hackerās Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/Ā£10.99.
[HEADING=1]Numerous recommendations[/HEADING]
āBlocking PowerShell hinders defensive capabilities that current versions of PowerShell can provide, and prevents components of the Windows operating system from running properly. Recent versions of PowerShell with improved capabilities and options can assist defenders in countering abuse of PowerShell,ā the NSA stated.
The advisory comes with a number of recommendations, including leveraging PowerShell remoting, or using Secure Shell protocol (SSH) to improve the security of public-key authentication.
āProper configuration of WDAC or AppLocker on Windows 10+ helps to prevent a malicious actor from gaining full control over a PowerShell session and the host,ā the document explained.
System admins can also hunt for signs of abuse on their endpoints by recording PowerShell activity and monitoring logs.
Read more
Patch PowerShell now, Microsoft tells admins
Microsoft warns users to update PowerShell āas soon as possibleā
Hackers have found a sneaky new way to infect Windows devices
Microsoft warns users to update PowerShell āas soon as possibleā
Hackers have found a sneaky new way to infect Windows devices
The latter allows admins to record every PowerShell input and output, getting a better understanding of the attackersā goals.
āPowerShell is essential to secure the Windows operating system,ā the NSA concluded, adding that, with proper configuration and management, it can be a great tool for system maintenance and security.
Via BleepingComputer
Continue readingā¦