So why should you use PowerShell for security tasks?
Well, first off, let's think a little bit differently. To know why
you should use PowerShell for security tasks,
you first need to understand the opposite,
which is why attackers choose PowerShell. The first thing is that it's the
default. It's installed by default on all new Windows computers.
Secondly,
it executes payloads or has the ability to execute
payloads directly from memory,
making it almost invisible. Of course, from an analysis perspective, it can
generate limited traces, which can often make it very complicated or
difficult to find when performing a forensic analysis.
It supports remote connectivity,
so there's support for remote access with encrypted traffic.
It can often bypass application whitelisting tools depending on the
tool and the configuration. And then, of course, really system
administrators like us and security people utilize PowerShell, and it
becomes very hard to see in the log entries, in the network traces
whether it's malicious PowerShell or its regular PowerShell because the
traffic is so similar.
There are many locations online with readily available scripts.
There are also multiple repositories with sample code,
often with some of those being malicious scripts.
There are also multiple security testing and hacking frameworks that are
available to download for PowerShell. PowerShell also makes it easy to
download files from the internet using multiple commands.
The advantage to this is that malicious actors can hide
downloads in what looks like seemingly legitimate
administration scripts. For example, you could use Invoke‑WebRequest,
Invoke‑RestMethod, or Start‑BitsTransfer. You could also
include a .NET class library and use the standard
System.Net.WebClient class for downloading.
An example of downloading files could be this where
we have a file called file.zip.
We have a URL where that file resides and then a
destination that we wish to send it to.
If we wish to utilize the Invoke‑WebRequest command,
then it's as simple as passing in the url and the OutFile.
We could also do the same thing using the BitsTransfer where it's a Source
url and Output file. And then the same goes for our Invoke‑RestMethod,
same principle, pass the url and the OutFile.
We could also go a little bit further, and if we were using the .NET class, we
have our same object so our file, our URL, and our destination. And from the
.NET class, it's as simple as reference in that System.Net.WebClient and then
utilizing the DownloadFile command.
So as you can see, it's very simple to do tasks such as downloading
files, which is what makes PowerShell a great tool for both malicious
actors and us as security administrators.
So why do you want to use PowerShell for security tasks? Well, let's talk
about the first one again. It's a built‑in command line tool.
Often, we don't even need to check if the command line tool exists because
it does. Unless your organization has restricted the use of PowerShell, it
will be on the devices that you are issued.
It, obviously, runs in memory and not in disk,
which means it has the potential of bypassing antivirus products.
Of course, it's included with every version of Windows,
so that means it's there by default.
Obviously, we talked about utilizing the .NET libraries. And, of
course, it has the built‑in commands for remote execution as well,
which is not just targeted to Windows.
It's across multiple devices that utilize and can support PowerShell.
Now, of course, why would you use PowerShell? Well,
it's a command line.
It means scripts can be executed through a standard command line, and if
you are a security professional or an administrator,
you love spending time at the command line and the console.
Of course, we can use the download capabilities to
download files which attackers use, which we talked about earlier.
Obviously, we've got monitoring.
Now many organizations don't enable monitoring, and obviously, that can be
enabled, and it can be extended to remote computers as well.
We also have the ability to be able to pass parameters such as NoProfile,
WindowStyle, and the most common, ExecutionPolicy, to enhance
our use of PowerShell. PowerShell commands blend in with
regular administration work as well.
And then, of course, from the PowerShell perspective, it provides easy access
to all major functions of an operating system like Windows.