Course Description

The primary objective of Windows PowerShell was to help IT professionals and power users control and automate the administration of the Windows operating system and applications that run on Windows.

To take advantage of the benefits that Windows PowerShell has to offer, while at the same time, minimise security-related risks, it is essential to understand the primary aspects of Windows PowerShell operational security. Another aspect that is critical to consider in the context of this course is the role of Windows PowerShell in security exploits.

You will then explore the most common Windows PowerShell-based techniques employed by hackers in order to leverage existing access to a Windows operating system to facilitate installation of malicious software, carry out reconnaissance tasks, establish its persistence on the target computer, and promote lateral movement. You will also review some of Windows PowerShell-based security tools that facilitate penetration testing, forensics, and reverse engineering of Windows PowerShell exploits. To conclude the course, you will provide a summary of technologies recommended by the Blue Team that are geared towards implementing comprehensive, defense-in-depth security against Windows PowerShell-based attacks.

Course Outline

Module 1, “PowerShell Fundamentals", In this module, you will learn about PowerShell fundamentals, including its architectural design, its editions and versions, and basics of interacting with PowerShell, you will learn in practical the difference between FullCLR and CoreCLR, how to install PowerShell core on Windows, Linux and MAC, and how to deal with PowerShell profiles.

Module 2, “PowerShell Operational Security", In this module, you will learn about enhancing operating system security by leveraging built-in Windows PowerShell features and technologies that are part of the Windows PowerShell operational environment.

In practical side of this module you will learn to deal with below:

1. Upgrade execution policy level to increase security level in your network.

2. Deal with code signing certificate.

3. Authenticate script file with authorized certificate.

Module 3, “Implementing PowerShell-based Security", The purpose of this module is to present the most common and effective methods of leveraging Windows PowerShell to enhance operating system security. These methods include:

1. Protecting from unintended configuration changes by relying on PowerShell Desired State Configuration (DSC)

2. Implementing the principle of least privilege in remote administration scenarios by using Just Enough Administration (JEA)

3. Tracking and auditing events that might indicate exploit attempts by using Windows PowerShell logging.

Module 4, “Windows PowerShell-based Exploits and their Mitigation ", In this module, we will first approach the Windows PowerShell-based security from the Red Team’s perspective. We will explore the most common Windows PowerShell-based techniques employed by hackers in order to leverage existing access to a Windows operating system to facilitate installation of malicious software, carry out reconnaissance tasks, establish its persistence on the target computer, and promote lateral movement. We will also review some of Windows PowerShell-based security tools that facilitate penetration testing, forensics, and reverse engineering of Windows PowerShell exploits. To conclude the module and the course, we will provide a summary of technologies recommended by the Blue Team that are geared towards implementing comprehensive, defense-in-depth security against Windows PowerShell-based attacks.

Module 5, “Network & Firewall", In this practical module, you will learn how to write ports scanner script, test network servers, and use 4 different methods to secure ports using firewall.

Module 6, “Domain inventory", In this practical module, you will learn how to detect suspected profile in any domain PCs, deploy your code for profile detection, write other inventory codes to create reports of ADgroups, users, GPOs ..etc, write script to manage registry key and values .

Module 7, “Domain shares", In this module, you will learn how to deal with network shares, you will write a script to manage following scenarios:

• Domain servers shares

• Shared Directory security info

• Network shares

  
  

By end of this course you have necessary skills to enroll into course 10: Hack windows Server 2019 using PowerShell & WMI, and you will be able to write the main tool script with 3500+ code lines in that course.