The increased use of PowerShell in attacks [pdf]

PowerShell is obviously a much better scripting language than the ancient DOS BAT &quot;language&quot; (if you can call it that). In theory it&#x27;s also mostly ubiquitous on Windows which means that you can rely on it being there when creating a script. Yet I&#x27;ve found that often people keep using BAT files (e.g. in build scripts, etc). I think it is because you cannot just execute a PowerShell script unless it is signed or the user has manually enabled non signed script execution (by executing a command on the PowerShell command). This means you cannot rely on it just working, at which point it&#x27;s often best to fall back to DOS or use another scripting language such a Python.<p>I understand that this is done for security reasons, but Windows already lets you execute any executable or BAT file that you might have downloaded from the Internet. So I&#x27;m not sure that disabling PowerShell script execution really gains you much (and there are probably other better solutions anyway).<p>So IMHO as long as DOS is available and PowerShell is so limited by default BAT files will not go away, which is unfortunate.

This is not very surprising at all.<p>The use of PowerShell is completely analogous to using shell scripts on linux, along with making use of things like the GNU core utils and other nearly universally-installed utilities (curl&#x2F;wget, tar, etc).<p>Traditionally there wasn&#x27;t a lot you could do purely from a shell or scripting environment on Windows -- all the &quot;good stuff&quot; was in Win32 APIs, hence needing to ship binaries.<p>Microsoft has been adding everything to PowerShell, to the point that you can now do nearly anything you can do with the GUI -- and in many cases more, since most of the administrative commands accept a -ComputerName parameter and are integrated with domain authentication. It&#x27;s only natural to take advantage of that.

I think this is just a observation that correlates with an increase in the usability of powershell. I have been very impressed with recent releases, they have a lot of functionality built in and the ecosystem is _finally_ starting to mature with NuGet and Chocolatey.

Not a huge surprise. A fairly ubiquitous, already installed interpreter that has routines to do system level stuff. Same reason PHP scripts are popularly uploaded by similar groups on Unix machines.

This explains why we&#x27;re not allowed to run <i>any</i> PowerShell scripts that are not signed by some IT root certificate on my work laptop. However, given that I can run any arbitrary executable (with user rights), this does seem a bit ridiculous.

I might be a bit biased working in offensive security, but 90% of the PowerShell I see in use is malicious.<p>Unfortunately Microsoft has let the genie out of the bottle, and most of the advancements in PowerShell security are centered around trying to add ACLs and logging to a scripting language, or figuring out how much of it you can disable and still have things work in production.<p>One of the best things we can hope to do going forward is sign on more Antivirus vendors to support Microsoft AMSI [1] which is basically a hook to pass PowerShell (and other scripting languages) off to your AV engine before they get executed.<p>1. <a href="https:&#x2F;&#x2F;msdn.microsoft.com&#x2F;en-us&#x2F;library&#x2F;windows&#x2F;desktop&#x2F;dn889587(v=vs.85).aspx" rel="nofollow">https:&#x2F;&#x2F;msdn.microsoft.com&#x2F;en-us&#x2F;library&#x2F;windows&#x2F;desktop&#x2F;dn8...</a>

So far as I know people have been using bash to implement atta cks on Unix systems since 1992 if not earlier.

Not that I have much to add here, but as a complete non-techie PowerShell seems amazingly powerful for this use.<p>I went from having no knowledge at all to having written a web scraping function and checked 7000 sites for a specific phrase in less than two hours. It was the most intuitive piece of technology I&#x27;ve ever used.

I love PowerShell. We use it to manage farms of machines, and I use Amazon&#x27;s excellent PowerShell aws library to do everything from managing my Route53 DNS to setting up new Amazon VPCs.<p>Security issues aside, it&#x27;s by far the best OS shell scripting language around, and it has concepts that make it different from any other attempt to write a shell language that includes pipes and redirections.

Is there a list of these symantec white papers to read?