<div dir="ltr"><a href="http://www.networkworld.com/article/3054786/security/power-shell-is-a-powerful-malware-tool.html">http://www.networkworld.com/article/3054786/security/power-shell-is-a-powerful-malware-tool.html</a><br><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p>PowerShell used as a tool in compound malware attacks is becoming
more common, with 38% of all attacks seen by IT security vendor
CarbonBlack and its partners involving the native Windows scripting
language.</p><p>Its use is so common in enterprises for
legitimate purposes that most security devices and personnel don’t
regard it as a threat, says Ben Johnson, the chief security strategist
at CarbonBlack.</p><p>That makes it all the more effective as a
component of attacks. Its scripts can run in memory only so it never
creates a file on disk, Johnson says. “It creates less noise on the
system,” so it’s less likely to draw attention to itself, he adds.</p> <p>It’s
also relatively easy to write a script for, making it more productive
for attackers to write a PowerShell script than to create compact binary
code that would accomplish the same goal, he says.</p><p>PowerShell’s
versatility is a strength but is also a downside when it’s viewed as an
attack tool. In that sense, “PowerShell is too powerful,” Johnson says.</p><p>There’s
no sure-fire way to stop this malicious use of PowerShell, but security
pros can start by monitoring its use to discover how it is being used
legitimately and by what applications. In most cases, for example,
Microsoft Office applications don’t spawn PowerShell as a process, so
that use would be considered suspicious.</p><p>If security pros log
PowerShell activity and analyze it for anomalies then they can write
rules to create alerts about known abnormal activity.</p> <p>They
should also look at the command lines. Often legitimate scripts have
lines such as “Ben’s Cleanup Script” that give an intuitive sense of its
purpose. Attackers often use Base64 encoding on the command line, often
incorporating the entire script in the line. “You’ll see it with crazy
arguments that humans would never use,” he says.</p><q>PowerShell is too powerful.</q><div id="drr-left">
<div class="">
<span class=""></span>
</div></div><p>Security
pros should identify who has a need to use PowerShell and others should
be restricted from using it. Admins legitimately use it to help with
upgrades and patches, but HR staff and the CFO’s office probably don’t
need it, he says. Use of PowerShell can also be restricted to certain
time windows to make it more difficult for attackers to sneak it by
unnoticed.</p><p>As it evolves, PowerShell is gaining security features,
so upgrading to a newer version can help. For example, PowerShell 5.0
supports better logging, including for deobfuscated code so it is
executed, according to <a href="https://www.carbonblack.com/files/powershell-deep-dive-a-united-threat-research-report/">“’PowerShell’ Deep Dive: A Unified Threat Research Report”</a>
written by CarbonBlack. “Note that newer versions of PowerShell are not
supported on older versions of Windows, so you may not be able to fully
upgrade all systems,” the report notes.</p><div id="drr-mod-0"><div class=""><form action="/resources/search" method="get">
</form>
</div>
</div><p>The report recommends setting standards for how PowerShell should be used:</p><ul><li>Change ExecutionPolicy to only allow signed scripts to run.</li><li>Require all PowerShell scripts to be run from a specific location or path.</li><li>Discourage (or require exception for) the use of encoded parameters on the command line.</li><li>Discourage (or block) PowerShell scripts from downloading content
from the Internet (or specify a “whitelist” of allowed IP addresses
only).</li><li>Discourage (or block) the use of PowerShell to invoke commands on remote systems.</li><li>Require a custom parameter to be passed on all “legitimate” PowerShell usage.</li><li>Restrict PowerShell to specific users in your organization.</li><li>Require PowerShell to be launched from a specific process.</li></ul><p>A relatively <a href="http://www.networkworld.com/article/3048472/new-ransomware-abuses-windows-powershell-word-document-macros.html">new iteration of ransomware called PowerWare</a>
is an example of PowerShell used maliciously. Distributed mainly via
phishing attacks, PowerWare initiates as macros within emailed Word
attachments. The macros launch an .exe file that starts up two
PowerShell instances, one to download the ransomware script and the
other to implement it.</p><p>PowerShell gives the attacker freedom of
movement within the compromised network. “You become an employee of your
target,” Johnson says.</p><br><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><span style="font-size:10pt"></span></b><span style="font-size:10pt"></span><span style="font-family:arial,helvetica,sans-serif"> </span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>