PowerShell was the source of more than a third of the critical security vulnerabilities identified in the second half of 2020, according to a Cisco survey released today at an RSA conference.
The top threat category found in all Cisco Secure Endpoint were dual-use tools used for exploitation and post-exploitation work.
PowerShell Empire, Cobalt Strike, PowerSploit, Metasploit and other similar tools have legitimate uses, Cisco says in its research, but they have also become common tools for attackers. Such practices are used to avoid detection when running foreign tools or code to compromise systems.
"Based on Cisco research, PowerShell is the source of more than a third of critical threats," says Gedeon Hombrebueno, Endpoint Product Manager Security by Cisco Secure.
Cisco recommends some protection steps that of course are facilitated with Cisco Secure Endpoint, but also some other EDR tools (from the endpoint detection and response).
However, there are some steps that administrators can (and should) do completely free of charge, such as preventing or restricting PowerShell from running in non-administrator accounts by allowing only signed script and the use of the Constrained Language function.
You can read detailed instructions for protecting PowerShell in the following white paper or try it PowerShell Protect
Intel Insights: How to Secure PowerShell