Overview

Even for seasoned PowerShell users, a deep and robust understanding of the language fundamentals can be incredibly powerful for writing more efficient, performant, and readable code. Section 1 focuses on building a solid foundation on which more complex use cases can be built. With a focus on functions specific to the Blue Team, this course section frames the discussion around the PowerShell basics in terms that will be immediately useful for students. For example, common data structures are discussed as a fundamental aspect of PowerShell, but quickly leveraged to perform actions across hundreds or thousands of systems. This foundation is built from the ground up and accessible to students with no prior scripting experience, but also with enough nuance to shed light on the "why does it work this way" questions posed by more seasoned PowerShell users. For professionals already very familiar with the section 1 concepts, PowerPlay offers an interactive, out-of-band challenge for students to drill more advanced concepts and techniques related to the course material.

Exercises

• Hands-On PowerShell: Get comfortable with PowerShell cmdlets, objects, and the pipeline to start making meaningful tools,
• PowerShell Remoting: Understand how to run remote commands in a way that scales, and build a model for secure remote access.
• Writing Performant PowerShell: Measure the impact of poorly written versus well-written PowerShell, leverage jobs and runspaces, and compare performance.
• Source Control: Become familiar with git concepts to effectively manage version control.

Topics

• Getting to know PowerShell
• Background and history
• Why PowerShell is such a good fit for Blue Teams
• Commands - How to use them and find them
• Objects and pipelines as PowerShell differentiators
• Extending PowerShell with .NET
• Language Basics
• Variables, data structures, and flow control
• Input and output
• Functions and script blocks
• PowerShell Environment
• Customizing the console
• Common development environments
• Debugging
• Static code analysis
• Tracing and breakpoints
• Helpful tools like Pester and PSScriptAnalyzer
• Remote Management
• PowerShell remoting basics and the underlying protocols
• Running remote commands
• Managing remote sessions
• Remoting endpoints/Constrained endpoints
• Enabling WinRM-based and cross-platform remoting
• Designing around the double-hop problem
• PowerShell Performance
• Coding techniques to maximize PowerShell performance
• Remoting performance tweaks
• Concurrency using native features
• Source Control
• Git terminology
• Creating repositories and branches
• Managing code with pull requests
• Driving release pipelines from source control

Overview

PowerShell-based automation provides a unique cross-platform mechanism to improve Blue Teams' speed of execution. This section focuses on better understanding one's own environment, maximizing visibility, and testing defensive capabilities using PowerShell. The section begins with a deep dive into log analysis and data parsing and discovery. The goal is to maximize the utility of native features of Operating Systems and applications while fully understanding how to find important data.

The section then moves into building integration with other systems. With modern API-driven orchestration, PowerShell can glue together multiple systems for better troubleshooting, investigation, detection, and response. This understanding can unlock functionality that would not otherwise be possible between disparate systems.

The section concludes with in-depth discussions on hardening infrastructure and maximizing visibility and detection capabilities. First, Desired State Configuration - PowerShell's configuration as code utility - can be used to consistently define and configure infrastructure using PowerShell to help ensure system integrity. Other hardening techniques discussed are built upon maximizing native security functionality. Lastly, we'll explain how better understanding visibility and detection capabilities in a repeatable format via automated testing techniques provides for a reliable and repeatable means of measuring one's capabilities.

Exercises

• Efficient Log Analysis: Understand how to analyze and filter Windows events and plaintext log files efficiently, and find attacks within sample log files.
• Integrating Technologies: Build API-based integration.
• Desired State Configuration (DSC): Leverage DSC to harden a system and turn it into an Incident Response powerhouse.
• Advanced Detections: Leverage native functionality to maximize hardening efforts with a focus on enabling efficient detection.
• Measuring Visibility with Atomic Red Team: Leverage Atomic Red Team to test and maximize visibility.

Topics

• Best Practices and Controlling PowerShell
• Maximizing readability and reusability of code
• Controlling PowerShell to minimize malicious use or misuse of the platform
• Just Enough Administration
• Log Analysis
• Enabling appropriate logging
• Reading and filtering Windows Event Logs
• Reading and filtering plaintext logs

• Text Parsing

  • Regular expressions and string operations to enable efficient parsing
• Integrations
• Making HTTP requests
• Web scraping
• API calls
• Authentication
• Handling session tokens
• Non-HTTP based integrations
• Desired State Configuration
• Benefits of configuration as code
• DSC architecture and deployment options
• DSC syntax
• Finding, building, and implementing DSC resources
• Workflow and use cases
• System Hardening
• Filesystem and registry controls
• Management of native endpoint functionality
• Know Thyself
• Understanding operational capabilities
• Visibility analysis
• Testing CIS Critical Security Controls compliance and visibility against the MITRE ATT&CK framework

Overview

This section combines the techniques discussed in the previous course sections in order to maximize detection and response capabilities. A common challenge faced by Blue Teams is the overwhelming amount of data generated by endpoints and security tooling. While this volume of data is meant to facilitate proper detection, it can be interpreted as noise and actually harm an organization's ability to detect threats. We'll discuss analysis techniques to use PowerShell to filter through some of this noise and engineer the ability to make better decisions based on the data provided.

Advanced detection techniques such as Event Tracing for Windows and deception on endpoints and the network are implemented to provide deep visibility and weaponize existing infrastructure against threat actors. Baselining is layered on top of these techniques to provide an ability to understand normal operating circumstances and identify outliers from that dataset.

Lastly, response techniques driven by PowerShell are enabled by Interactive Notebooks where analysts can combine documentation and executable code with their output. Response techniques meant to maximize visibility can help an operations team better understand if anomalous conditions warrant further containment and investigation. On the other hand, once malicious intent is identified, response techniques focused on containment can be automated to mitigate additional harm.

Exercises

• Event Tracing for Windows (ETW): Become familiar with ETW providers and their usage for detection purposes.
• Baseline Analysis: Build a baseline object that protects integrity while profiling network and user behavior.
• Deception: Implement several deception techniques to identify attacker behavior.
• Response - Visibility: Build automation to more quickly understand the context around an event.
• Response - Containment: Build automation to more quickly contain threats.

Topics

• Analyzing Large Data Sets
• Feeding data to SIEMs and Big Data systems
• Analysis techniques to identify events of interest
• N-Gram analysis for identifying unusual strings
• PowerShell class structure and implementation
• Event Tracing for Windows
• Architecture and Blue Team use cases
• Providers
• Trace sessions
• Packet captures in PowerShell
• ETW tampering and detection
• Baselining
• Converting baseline data to objects and storing them securely
• Baseline creating strategies
• Types of baselines and implementations
• PowerShell-based tools for baselining
• Automating Deception
• Network-deception techniques
• System-deception techniques
• User-deception techniques
• Cloud-deception techniques
• Interactive Notebooks
• Jupyter Notebooks use cases
• PowerShell on Jupyter/.NET Interactive
• Use cases and implementation
• Short-term Response - Visibility
• Network and user-based enumeration
• Enabling deeper auditing as an ad hoc response
• Enrichment of existing data
• Short-term Response - Containment
• Mitigating credential theft impact
• System containment - process and behavior restriction
• Network containment