NSA Issued an Advisory for System Administrators to use PowerShell for Detecting Malicious Activity

A recent advisory from the National Security Agency (NSA) recommended that system administrators use PowerShell to manage systems. PowerShell is a program that can be used to detect and prevent malicious activity that occurs on Windows systems.

Cyberattacks highly rely on PowerShell, mainly in the post-exploitation phase, in order to accomplish their goals. Microsoft’s automated, and configuration tool can also be beneficial to defenders due to its embedded security features.

There is a set of recommendations that make use of PowerShell to mitigate digital threats that have been created by the NSA along with the following security agencies:-

• The U.S. (CISA)
• New Zealand (NZ NCSC)
• The U.K. (NCSC-UK)

PowerShell Security Methods

Here below we have mentioned all the PowerShell methods to reduce and detect security abuse:-

• Credential protection during PowerShell remoting
• Network protection of PowerShell remoting
• Antimalware Scan Interface (AMSI) integration
• Constrained PowerShell with Application Control
• Deep Script Block Logging (DSBL) and module logging
• Over-the-Shoulder (OTS) transcription

In order to use this feature on a private network, administrators should be aware that Windows Firewall automatically adds a rule that allows all connections on the private network.

Windows Firewall could be customized to only accept connections from devices and networks that are flagged as trusted. Thereby reducing the chances for lateral movement to be successful on the attacker’s part.

Features of PowerShell

It is imperative to take a closer look at the features provided by various PowerShell versions to help ensure their environments are better protected.

Here in below table, you can see the features provided:-

NSA releases a document asserting the following statement:-

PowerShell is an essential tool for keeping the Windows operating system secure, especially as there are no more limitations in the newer versions of PowerShell.

Configuring and maintaining PowerShell correctly can make it a reliable tool if it is managed correctly. By using this, there is the possibility of being able to do the following things:-

• System maintenance
• Forensics
• Automation
• Security tasks

It is essential to properly manage and adopt PowerShell, together with its administrative abilities and security features.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.