How to keep attackers from using PowerShell against you

Living off the land is not the title of a gardening book. It’s the goal of attackers going after your network. Rather than installing malicious software on your network that antivirus software might flag, attackers use the code already there to launch attacks. The tools that you use to monitor, maintain and access your network are often the same code that attackers use to attack your network. PowerShell is a prime example.

The U.S. National Security Agency (NSA), U.S. Cybersecurity and Infrastructure Security Agency (CISA), New Zealand’s NCSC, and the UK NCSC recently released a document called Keeping PowerShell: Security Measures to Use and Embrace. This guidance recommends keeping PowerShell in your network rather than blocking but offers the following advice to keep it secure.

Use PowerShell remoting only where needed

First, decide where you want to use PowerShell remoting and where you don’t want it to be functional. Too many companies do not take the time to use the technology they have to control communication. The Windows firewall can be set with Group Policy or Intune to block PowerShell remoting.

First review what access rights you have set by using the following command:
Get-PSSessionConfiguration | Format-Table -Property Name, Permission

You can disable PowerShell remoting by using the following command:
Disable-PSRemoting -Force

If you enable PowerShell remoting through Enable-PSRemoting, it automatically opens port 5895 in Windows Firewall. To disable the firewall exceptions, use the Windows Firewall with Advanced Security MMC snap-in (type “firewall” in the Start menu) and search for “Windows Remote Management (HTTP-In) rules”. There is one rule for the network profile domain (private) and one for public. Select “Inbound Rules”, then right-click on each rule and select “Disable”. You may also wish to set this rule to ensure that attackers can’t silently enable it. You can also enable “Firewall auditing” so that you are alerted when a firewall rule changes from the values you have set.