PowerShell was the source of more than a third of the critical security vulnerabilities identified in the second half of 2020, according to a Cisco survey released today at an RSA conference.
The top threat category found in all Cisco Secure Endpoint were dual-use tools used for exploitation and post-exploitation work.
PowerShell Empire, Cobalt Strike, PowerSploit, Metasploit and other similar tools have legitimate uses, Cisco says in its research, but they have also become common tools for attackers. Such practices are used to avoid detection when running foreign tools or code to compromise systems.
"According to Cisco Research, PowerShell is the source of more than a third of critical threats," says Gedeon Hombrebueno, Cisco Secure Endpoint Security Product Manager.
Cisco offers some protection steps that, of course, are facilitated by Cisco Secure Endpoint, but also some other EDR tools (from endpoint detection and response).
However, there are some steps administrators can (and should) take completely free of charge, such as preventing or limiting it implementationPowerShell to non-administrator accounts, allowing only signed scripts to run and the Constrained Language feature to be used.
You can read detailed instructions for protecting PowerShell below white paper or try it PowerShell Protect
Intel Insights: How to Secure PowerShell
