“... PowerShell ... version 6.0 ... executable is changing names from powershell.exe to pwsh.exe...”
Friday, January 19, 2018
Infosec quotes - insider risk AV
Could an insider risk use your AV to collect all sensitive documents ? Apparently so.
Infosec quotes - meltdown register
Note from @gossithedog “...with Microsoft Meltdown patches - Customers will not receive these security updates and will not be protected from security vulnerabilities unless their anti-virus software vendor sets the following registry key...because certain AV hook the kernel in a bad way...”
Infosec quotes - chrome meltdown
The new CPU attacks (spectrum and meltdown) also impact Chrome. Watch for the patch to come.
“... Chrome's JavaScript engine, V8, will include mitigations starting with Chrome 64, which will be released on or around January 23rd 2018...”
Infosec quotes - Firefox meltdown
The new CPU attacks (spectrum and meltdown) you read about in the news apparently can be launched from browsers. Patch for Firefox.
Infosec quotes - Powershell Security
Simple initial steps to Securing Powershell
Tip 1
setup host based firewall to prevent powershell from accessing the internet / proxy, will prevent a lot of common 2nd stage droppers or persistence
Tip 2
Use applocker to prevent your general users from running powershel.exe. You can create a very permissive ruleset which allows admins, service accounts etc to run powershell but your general user population from using it.
Credit the SANS advisory board
Infosec quotes - security first
“... Businesses need to think security first...Whether that’s in designing new products and services, signing partnership agreements, in hiring new employees, or anything else...”
Subscribe to:
Posts (Atom)