{"action":"created","issue":{"url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/345","repository_url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools","labels_url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/345/labels{/name}","comments_url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/345/comments","events_url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/345/events","html_url":"https://github.com/osisoft/PI-Security-Audit-Tools/issues/345","id":299131482,"number":345,"title":"Add machine check for PowerShell security","user":{"login":"hpaul-osi","id":18221184,"avatar_url":"https://avatars2.githubusercontent.com/u/18221184?v=4","gravatar_id":"","url":"https://api.github.com/users/hpaul-osi","html_url":"https://github.com/hpaul-osi","followers_url":"https://api.github.com/users/hpaul-osi/followers","following_url":"https://api.github.com/users/hpaul-osi/following{/other_user}","gists_url":"https://api.github.com/users/hpaul-osi/gists{/gist_id}","starred_url":"https://api.github.com/users/hpaul-osi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hpaul-osi/subscriptions","organizations_url":"https://api.github.com/users/hpaul-osi/orgs","repos_url":"https://api.github.com/users/hpaul-osi/repos","events_url":"https://api.github.com/users/hpaul-osi/events{/privacy}","received_events_url":"https://api.github.com/users/hpaul-osi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-21T21:15:55Z","updated_at":"2018-05-23T00:48:41Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Attackers have been living of the land with PowerShell for years because of it's capabilities, however, the platform offers significant protections that can make PowerShell the most secure scripting option available.  An audit check to look for the following would help identify if PowerShell is a liability in its current state.\r\n\r\n- Version - More recent versions have more security features.\r\n- Remove Legacy Components - Remove PS2 and .NET 3.5 if possible.\r\n- Execution Policy - Similar to UAC, this is not going to stop an attacker, but can give your users a fighting chance to avoid mistakes.\r\n- Constrained Language Mode - Reduces the functionality available.  Default enabled with whitelisting on.\r\n- Logging - Transcripts and module logging (combined with WEF) mean that attackers will leave fingerprints everywhere.\r\n\r\nSee [PowerShell Security at Enterprise Customers](https://blogs.msdn.microsoft.com/daviddasneves/2017/05/25/powershell-security-at-enterprise-customers/) for more information."},"comment":{"url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/comments/391185635","html_url":"https://github.com/osisoft/PI-Security-Audit-Tools/issues/345#issuecomment-391185635","issue_url":"https://api.github.com/repos/osisoft/PI-Security-Audit-Tools/issues/345","id":391185635,"user":{"login":"DCPDamon","id":36771716,"avatar_url":"https://avatars2.githubusercontent.com/u/36771716?v=4","gravatar_id":"","url":"https://api.github.com/users/DCPDamon","html_url":"https://github.com/DCPDamon","followers_url":"https://api.github.com/users/DCPDamon/followers","following_url":"https://api.github.com/users/DCPDamon/following{/other_user}","gists_url":"https://api.github.com/users/DCPDamon/gists{/gist_id}","starred_url":"https://api.github.com/users/DCPDamon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DCPDamon/subscriptions","organizations_url":"https://api.github.com/users/DCPDamon/orgs","repos_url":"https://api.github.com/users/DCPDamon/repos","events_url":"https://api.github.com/users/DCPDamon/events{/privacy}","received_events_url":"https://api.github.com/users/DCPDamon/received_events","type":"User","site_admin":false},"created_at":"2018-05-23T00:48:41Z","updated_at":"2018-05-23T00:48:41Z","author_association":"NONE","body":"You might have a hard time with .NET 3.5.  There are still a ton of PI applications that can't run without it..."}}
{"actor":{"display_login":"DCPDamon"}}