So what security tasks can PowerShell handle?
Well first off, this would be log and file analysis.
We have the ability to connect into the core operating
system and retrieve logs and files, not just from the operating system,
but potentially from applications that are running on those devices as well.
We can also perform information gathering,
so getting operating system specifics or also network analysis.
We can obviously create task automation and scheduling,
which is great when you are trying to perform various
tasks and maybe long running jobs, then we can utilize PowerShell for that too.
And then, of course, we can do security configuration and management.
So that means we can enable or disable specific security
controls and features within devices such as a Windows
machine by utilizing PowerShell.
So let's talk about log and file analysis.
Well the first thing we can do, which is most common,
is we can pass event logs with Windows operating system.
We can also get them from other operating systems as well,
but Windows obviously natively as part of PowerShell,
but of course it does work with things like Linux as well.
We can also retrieve file contents and associated metadata.
So if we're utilizing PowerShell as part of a penetration test,
for example, or an assessment or audit,
we could retrieve files and retrieve information as well.
And lastly, we can perform advanced queries within those files,
within the logs, and other types of content.
So, when we tie this all together from a log and file analysis,
we are able to really build a picture of maybe what
took place in a security breach,
so for example using PowerShell for Forensics or if we're
performing the assessment or test or audit ourselves,
then we can go through and retrieve all the information that we need.
From an information gathering perspective,
there's some basic information that PowerShell provides
us depending on the types of machines.
The first one will be the computer name.
So this name is the device's NetBIOS or DNS name,
the one that makes it identified on the network.
Now a device could obviously have more than one IP address or
more than one MAC address or something else,
but the names are obviously going to be unique so we
can identify the names of machines.
We can also get the IP addresses and the network adapters
that the IP addresses are associated to.
We can also retrieve operating system service pack hotfixes.
All that information is available to us as part of utilizing PowerShell.
We can also retrieve domain membership information as well.
This is where we determine if it's connected to an Active
Directory server or if there's security policies or
controls that have been put in place.
We can also get physical locations as well.
So this information is really just the location of
the device in the organization,
but this will help you determine if it's participating in
some type of isolation group or if it's communicating with
certain types of devices.
And then we can also retrieve hardware type or role information.
So when we use PowerShell,
we can sometimes perform a host discovery that will query
the hardware information and any of the running
applications to determine its type, is it a server,
a workstation, a portable device,
and then you can use this information to determine what
you want to do as far as attacking would go or if you're
just retrieving information, then it could be,
well, what do we do with that information once we have it?
Our next thing is we can use PowerShell for task automation.
We have the ability to create single tasks.
So you can use PowerShell to create a single one‑off task
that is either single or multiple commands.
You can also create scripts that perform single tasks sequentially.
Then, of course, we can create a script using multiple
PowerShell commands that execute logically one after another,
also make decisions based on defined logic.
You can also use this for incident response by recognizing
specific types of events and then performing actions.
We can also use PowerShell to remotely connect to single or
multiple machines and then initiate other tasks.
These tasks could also be the single or multiple ones that we talked about
and they could return values to you or the remote machine that you're
working from. And then we can also schedule tasks.
So within most operating systems, you can utilize a specific engine
for creation management and control of tasks.
PowerShell can connect to some of these engines directly or you can
utilize connectors to easily manage scheduled tasks.
Now from a security configuration perspective,
we are able to utilize multiple security frameworks so
that we can perform configuration or that we can use those
frameworks for investigation.
We can also directly use PowerShell commands to implement best practices.
So, for example, there's lots of documentation available on Microsoft,
for example, of how to implement specific types of controls,
whether it's on‑premises or in the cloud,
utilizing PowerShell. And then we can also use what's called PowerShell DSC,
which can be used to harden windows operating systems by removing or
switching on or off specific security controls.