4 ms·
>PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script. GPO prevents this but
by 0xDEFC0DE 7y ago
>PowerShell execution policy is stupid easy to bypass. You simply pass the '–ExecutionPolicy Bypass' parameter when launching the script.
GPO prevents this but if you have local system you can override that locally and then change execution policy.
I’m sorry, I don’t say this often but you don’t know what you’re doing so I’m not going to take the time for the rest of your post. I’d encourage you to research this more if you like it.
- AnIdiotOnTheNet 7y agoSince the account is compromised and can run any executable it damn well pleases, I'm not even sure how preventing powershell from running a script is at this point is supposed to help. You strike me as a very typical infosec person, always endeavoring to make mountains out of molehills and add unnecessary friction to everyone else's job in order to add minor benefits in highly improbable scenarios.
- 0xDEFC0DE 7y agoAgain, defense in depth. Don’t discard additional layers of security because one layer fell. The idea is to exhaust attackers and make it cost ineffective. PowerShell empire and mimikatz are two popular things that require it. I am not in infosec though All things considered, thanks for discussing this with me despite my harsh language and tone. It’s a bad habit of mine