Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying PowerShell Automation and Scripting for Cybersecurity
  • Table Of Contents Toc
  • Feedback & Rating feedback
PowerShell Automation and Scripting for Cybersecurity

PowerShell Automation and Scripting for Cybersecurity

By : Miriam C. Wiesner
4.8 (23)
close
close
PowerShell Automation and Scripting for Cybersecurity

PowerShell Automation and Scripting for Cybersecurity

4.8 (23)
By: Miriam C. Wiesner

Overview of this book

Take your cybersecurity skills to the next level with this comprehensive guide to PowerShell security! Whether you’re a red or blue teamer, you’ll gain a deep understanding of PowerShell’s security capabilities and how to use them. After revisiting PowerShell basics and scripting fundamentals, you’ll dive into PowerShell Remoting and remote management technologies. You’ll learn how to configure and analyze Windows event logs and understand the most important event logs and IDs to monitor your environment. You’ll dig deeper into PowerShell’s capabilities to interact with the underlying system, Active Directory and Azure AD. Additionally, you’ll explore Windows internals including APIs and WMI, and how to run PowerShell without powershell.exe. You’ll uncover authentication protocols, enumeration, credential theft, and exploitation, to help mitigate risks in your environment, along with a red and blue team cookbook for day-to-day security tasks. Finally, you’ll delve into mitigations, including Just Enough Administration, AMSI, application control, and code signing, with a focus on configuration, risks, exploitation, bypasses, and best practices. By the end of this book, you’ll have a deep understanding of how to employ PowerShell from both a red and blue team perspective.
Table of Contents (19 chapters)
close
close
1
Part 1: PowerShell Fundamentals
6
Part 2: Digging Deeper – Identities, System Access, and Day-to-Day Security Tasks
12
Part 3: Securing PowerShell – Effective Mitigations In Detail

To get the most out of this book

For most chapters, you will need PowerShell 7.3 and above, as well as a Visual Studio Code installation to examine and edit your code.

Depending on the chapter you follow, we will also look at other technologies, such as Windows PowerShell 5.1, Visual Studio, C/C++/C#, Visual Basic, Assembly, Ghidra, Wireshark, and Microsoft Excel.

Software/hardware covered in the book

Operating system requirements

PowerShell 7.3 and above

Windows 10 and above

Windows PowerShell 5.1

Windows Server 2019 and above

Visual Studio Code

Although most examples in this book might work with one test machine only, it is highly recommended to set up a demo environment to improve your experience for some parts of this book.

I used virtual machines to set up my environment, and I recommend doing the same to follow along. Hyper-V is a free hypervisor that you can use to set up your machines.

For my demo environment, I set up the following machines, which I will reference throughout this book:

  • PSSec-PC01: 172.29.0.12, Windows 10 Enterprise, 22H2, joined to the domain PSSec.local
  • PSSec-PC02: 172.29.0.13, Windows 10 Enterprise, 22H2, joined to the domain PSSec.local
  • PSSec-Server: 172.29.0.20, Windows Server 2019 Datacenter, joined to the domain PSSec.local
  • DC01: 172.29.0.10, Windows Server 2019 Datacenter, hosting the domain PSSec.local
    • Installed relevant roles: Active Directory Certificate, Active Directory Domain Services, DNS Server, and Group Policy Management
  • Azure demo environment for Chapter 7: PSSec-Demo.onmicrosoft.com
  • Optional: Linux and macOS to follow the PowerShell remoting (SSH) configuration in Chapter 3

The following diagram demonstrates the relevant setup used in this book:

Figure P.1 – The setup used in this book

This setup is only configured in a test environment and should, therefore, not be used in production environments.

If you are using the digital version of this book, we advise you to type the code yourself or access the code from the book’s GitHub repository (a link is available in the next section). Doing so will help you avoid any potential errors related to the copying and pasting of code.

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech

Create a Note

Modal Close icon
You need to login to use this feature.
notes
bookmark search playlist download font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Delete Note

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Edit Note

Modal Close icon
Write a note (max 255 characters)
Cancel
Update Note

Confirmation

Modal Close icon
claim successful

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY