{"id":5053,"date":"2017-01-17T14:07:04","date_gmt":"2017-01-17T20:07:04","guid":{"rendered":"http:\/\/www.filecloud.com\/blog\/?p=5053"},"modified":"2022-04-21T08:20:21","modified_gmt":"2022-04-21T13:20:21","slug":"10-powershell-security-scripts-for-analyst-and-administrators","status":"publish","type":"post","link":"https:\/\/www.filecloud.com\/blog\/10-powershell-security-scripts-for-analyst-and-administrators\/","title":{"rendered":"10 PowerShell Security Scripts for Analyst and Administrators"},"content":{"rendered":"

Out of numerous Windows admin tools, PowerShell is one of the most valuable tools. It offers scripting language flexibility and command line speed, making it incredibly effective to automate important security chores. Using PowerShell, Windows administrators gain the ability to automate various tasks, like managing users, deploying patches, and rotating logs. Using PowerShell isn\u2019t difficult, once you get the hang of it. In fact, you can use it for both security-based jobs and certain Windows administration tasks. Do you want to monitor attack activities or need to manage your certificates? PowerShell has you covered.
\nDue to the versatility of PowerShell, it\u2019s not unusual for someone to create a PowerShell module or script that focuses on security. Windows admins enjoy access to a wide range of scripts from the community, capable of handling security tasks of varying magnitudes. This covers everything from network forensics to penetration testing, certificate management to event logging. Below we\u2019ll take a look at how the endless potential of PowerShell security scripts proves indispensable to Windows admins, and discuss the 10 best ones among them.<\/p>\n

\u00a0\n<\/p>\n

1. List $Profile<\/h4>\n

The actual user connected to the machine is dubbed \u201cuser.\u201d On the other hand, \u201chost\u201d is used for the host application that connects to the PowerShell engine. Thus, a single host can have different profiles, and each one of them has an associated file stored in a specific location. For easy maintenance and security, a single file can be used for managing multiple profiles. All the user needs to do is add conditions to this file to prevent a non-supported command from being executed by the \u201chost.\u201d There are lots of people who\u2019d be more comfortable separating the profiles into individual files. This would free them from the burden of having to maintain a PS1 that is extremely complex.<\/p>\n

\u00a0<\/p>\n

2. Add-PSSnapIn<\/h4>\n

Windows PowerShell security script allows for the creation of custom profiles. These profiles support snap-ins and modules. Though this slows down the start-up time of the PowerShell console, it bodes well for the security of your system.
\nPowerShell profiles assist with system administration, but being just a PS1 file, it remains exposed to the risk of malicious code. Even when the default location is in a user\u2019s directory and the file remains protected from access by all users, it can be changed to execute commands without your knowledge. To prevent this from happening, you can do two things \u2013 either you can make use of NTFS permissions to set limits on modifying permissions for these files, especially for the admin account or you can sign the file digitally and then configure PowerShell in a way that it employs a more restrictive strategy for execution. The recent PowerShell versions add an extra layer of security by helping users set up their choice of strategic security.<\/p>\n

\u00a0<\/p>\n

3. Get-ExecutionPolicy<\/h4>\n

Suppose you are working on a server that is entirely unknown to you. In this case, you first need to know what sort of execution policy is currently being used before you try to run some script. Finding out this information is easy when you use the command Get-ExecutionPolicy.<\/p>\n

\u00a0<\/p>\n

4. Get-EventLog<\/h4>\n

\"powershell
\nhttp:\/\/windowsitpro.com\/site-files\/windowsitpro.com\/files\/archive\/windowsitpro.com\/content\/content\/99879\/figure1.jpg
\nPowerShell may actually be used to parse the event logs present in your system. Though there are several ways to go about this process, the best one for this particular command is just to offer the \u2013Log switch accompanied by the log file name. For example, you can use commands like Get\u2013EventLog \u2013Log \u201cApplication\u201d to view the Application log. You then need to filter the output and understand whether your system is safe or not.<\/p>\n

\u00a0<\/p>\n

5. Get-Service<\/h4>\n

\"Foreachservice\"
\nhttps:\/\/redmondmag.com\/articles\/2016\/01\/22\/~\/media\/ECG\/redmondmag\/Images\/2016\/01\/ForEachService_Fig1.ashx
\nWhen you give this command, it offers up a list of every service that is currently installed on your system. If you think that a particular service is worth checking out for security, then it\u2019s possible to append the \u201c\u2013Name\u201d switch as well as the service name. You\u2019re allowed to use wildcards. Once you\u2019re done, you\u2019ll be shown the state of the service by Windows.<\/p>\n

\u00a0<\/p>\n

6. Get-Process<\/h4>\n

\"getprocess\"<\/p>\n

Unlike the Get-Service command in PowerShell, which displays a list of the different system services at your discretion, Get-Process command, if used capably, can display a whole list of each and every process that the system currently runs.<\/p>\n

\u00a0<\/p>\n

7. Stop-Process<\/h4>\n

It is not uncommon for a particular process to lag or freeze up from time to time. This is often a nuisance and causes a lot of problems. To prevent this, use the Get-Process command so that you have the process ID or name of the program that didn\u2019t respond. You can then terminate this problematic process using the Stop-Process command. A process can be terminated based on its process ID or name. However, you should understand that the process ID changes from one session to another.<\/p>\n

\u00a0<\/p>\n

8. Digital Signature<\/h4>\n

The TimeStampServer command helps you verify whether a particular PowerShell script was signed at a certain time. The majority of certificates remain valid for a period of one year. Once the date of expiration comes closer, the usage of this parameter doesn\u2019t allow the code itself to expire. You are then able to use it as long as it hasn\u2019t been modified. If a modification has been conducted, then you\u2019ll have to sign it again using a valid certificate.<\/p>\n

\u00a0<\/p>\n

9. Set-Execution Policy<\/h4>\n

\"set
\nhttp:\/\/2.bp.blogspot.com\/-DvqcAZzw_RM\/T3GzmL_CRXI\/AAAAAAAAAG4\/b89yOhFrUIg\/s1600\/2.jpg
\nYou are capable of creating and executing PowerShell scripts as you want. However, Microsoft no longer supports scripting by default. This has been done to prevent any malicious code from getting executed in a PowerShell setting. This command can then be used to control the security level of the PowerShell scripts. There are four different layers of security, ranging from Unrestricted to Restricted, Remote Signed to All Signed. This kind of flexibility is much-need in a PowerShell security script, and you can set them with the help of the Set-Execution Policy command along with the policy name.<\/p>\n

\u00a0<\/p>\n

10. Set-AuthenticodeSignature<\/h4>\n

While trying to configure a group policy object, you must sign your profile with this particular certificate. Otherwise, the security of your Windows system will be seriously undermined.
\nIn a PowerShell environment, it is extremely important for Windows admins to secure their system via scripts, but you shouldn\u2019t let that turn into a restriction. Thus, prior to deploying your policy, you must have a test plan in place that will ensure no problem from the signed scripts. The PowerShell security scripts listed above are indispensable since they\u2019ll keep the system well-protected and efficient.<\/p>\n

\u00a0<\/p>\n

Author: Rahul Sharma<\/strong><\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n

Source:
\nhttp:\/\/www.infoworld.com\/article\/3148664\/security\/10-essential-powershell-security-scripts-for-windows-administrators.html<\/p>\n

PowerShell Day-to-Day SysAdmin Tasks: Securing Scripts<\/a><\/p><\/blockquote>\n