Stop Writing Insecure PowerShell... Seriously.
summary
Demonstrates concrete fixes: runs PSScriptAnalyzer with built‑in security rules, adds InjectionHunter and a custom AST‑based rule that flags four fake SSNs, and wires those checks into a GitHub Actions CI that fails on injection violations (three violations triggered in the demo). Shows an exploitable get‑whois module where Invoke‑Expression downloads a payload, and uses Microsoft.PowerShell.SecretManagement + SecretStore to replace hardcoded credentials with vault‑backed secrets.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 2:18Insecure PowerShell patterns
- 3:00PowerShell Script Analyzer
- 6:50Script Analyzer on insecure code
- 9:58Extending Script Analyzer with Injection Hunter
- 13:11Injection attacks with Invoke-Expression
- 17:44Custom rules for PII detection
- 25:47Script Analyzer for CI/CD
- 31:05Script Analyzer in GitHub Actions
- 36:04PowerShell Secret Management
- 43:47Module safety evaluation
- 45:11Closing and Q&A
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
49mPowerShell for Security Incident Response
49mProvenance Before Publish: Building Safer PowerShell and Chocolatey Pipelines
41mHow Secure Can You Be?
57mSecuring PowerShell: Hands-On Lab
49mPowerShell obfuskation Techniques & How To Detect Them
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
47mAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It