PowerShell Security¶

PowerShell is a powerful administration and automation tool, but because it can execute scripts and interact deeply with the operating system, it must be secured properly. Attackers often abuse PowerShell for tasks such as running malicious scripts, downloading payloads, bypassing controls, or performing reconnaissance. For this reason, PowerShell security should focus on controlling script execution, logging activity, reducing unnecessary permissions, and enforcing trusted code practices.

Execution Policy¶

PowerShell Execution Policy controls the conditions under which PowerShell loads configuration files and runs scripts. It is not a complete security boundary, but it helps prevent accidental execution of untrusted scripts.

Common execution policy levels include:

To check the current execution policy:

Get-ExecutionPolicy -List

To set a safer policy for the local machine:

Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

Script Signing¶

Script signing helps verify that a script came from a trusted source and has not been modified. In higher-security environments, using AllSigned can reduce the risk of unsigned or tampered scripts being executed.

Set-ExecutionPolicy AllSigned -Scope LocalMachine

Logging and Monitoring¶

PowerShell activity should be logged and monitored, especially on servers and administrator workstations. Important logging options include:

• Module Logging
• Script Block Logging
• PowerShell Transcription
• Event Log monitoring

These logs can help detect suspicious commands, encoded payloads, privilege abuse, and attacker activity.

Constrained Language Mode¶

Constrained Language Mode limits what PowerShell can do, reducing access to advanced features that attackers may abuse. It is commonly used with application control technologies such as Windows Defender Application Control or AppLocker.

Least Privilege¶

PowerShell should be run with the minimum permissions required. Administrators should avoid running daily sessions as elevated users unless necessary. Reducing local administrator access limits the damage caused by compromised accounts or malicious scripts.

Secure Remoting¶

PowerShell Remoting is useful for managing systems remotely, but it should be secured carefully. Recommended practices include:

• Use trusted administrative accounts
• Restrict who can use remoting
• Use Just Enough Administration, also known as JEA
• Monitor remote PowerShell sessions
• Avoid exposing WinRM unnecessarily

Common Security Risks¶

Common PowerShell security risks include:

• Running scripts from unknown sources
• Using Bypass execution policy without control
• Executing encoded commands
• Disabling logging
• Running PowerShell as administrator unnecessarily
• Allowing unrestricted remoting
• Storing credentials directly inside scripts

Best Practices¶

Recommended PowerShell security controls include:

• Use RemoteSigned or AllSigned
• Enable Script Block Logging
• Enable PowerShell Transcription
• Monitor PowerShell-related Windows Event Logs
• Restrict PowerShell Remoting access
• Use least privilege
• Use JEA for delegated administration
• Avoid hardcoded passwords or secrets
• Store secrets in a secure vault
• Keep PowerShell updated
• Review scripts before execution

Summary¶

PowerShell is extremely useful for automation and administration, but it must be managed securely. Execution Policy, script signing, logging, least privilege, and secure remoting all help reduce risk. Execution Policy alone is not enough, so it should be combined with monitoring, access control, and strong operational security practices.