powershell-security-hardening

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

PowerShell Security Hardening

PowerShell安全加固

Purpose

用途

Provides expertise in Windows security hardening and PowerShell security configuration. Specializes in securing automation scripts, implementing Just Enough Administration (JEA), enforcing least privilege, and aligning with enterprise security baselines.

提供Windows安全加固与PowerShell安全配置方面的专业支持，专注于自动化脚本安全防护、Just Enough Administration (JEA)实施、最小权限管控以及与企业安全基线对齐。

When to Use

适用场景

Configuring PowerShell security policies
Implementing Constrained Language Mode
Setting up Just Enough Administration (JEA)
Enabling PowerShell logging and auditing
Securing automation credentials
Applying CIS/STIG baselines
Protecting against PowerShell attacks
Implementing execution policies

配置PowerShell安全策略
实施Constrained Language Mode
部署Just Enough Administration (JEA)
启用PowerShell日志记录与审计
保护自动化凭据安全
应用CIS/STIG安全基线
防御PowerShell攻击
执行策略实施

Quick Start

快速入门

Invoke this skill when:

Hardening PowerShell environments
Implementing JEA or constrained language mode
Configuring PowerShell logging
Securing automation credentials
Applying security baselines

Do NOT invoke when:

General Windows administration → use
```
/windows-infra-admin
```
PowerShell development → use
```
/powershell-7-expert
```
Active Directory security → use
```
/ad-security-reviewer
```
Network security → use
```
/network-engineer
```

在以下场景调用此技能：

加固PowerShell环境
实施JEA或受限语言模式
配置PowerShell日志
保护自动化凭据
应用安全基线

请勿在以下场景调用：

通用Windows管理 → 使用
```
/windows-infra-admin
```
PowerShell开发 → 使用
```
/powershell-7-expert
```
Active Directory安全 → 使用
```
/ad-security-reviewer
```
网络安全 → 使用
```
/network-engineer
```

Decision Framework

决策框架

Security Requirement?
├── Script Execution Control
│   ├── Basic → Execution Policy
│   └── Strict → AppLocker/WDAC
├── Language Restriction
│   └── Constrained Language Mode
├── Privilege Reduction
│   └── JEA (Just Enough Administration)
└── Auditing
    └── Script Block Logging + Transcription

Security Requirement?
├── Script Execution Control
│   ├── Basic → Execution Policy
│   └── Strict → AppLocker/WDAC
├── Language Restriction
│   └── Constrained Language Mode
├── Privilege Reduction
│   └── JEA (Just Enough Administration)
└── Auditing
    └── Script Block Logging + Transcription

Core Workflows

核心工作流

1. PowerShell Logging Setup

1. PowerShell日志配置

Enable Script Block Logging via GPO
Enable Module Logging for key modules
Configure transcription to secure location
Set up protected event log forwarding
Create alerts for suspicious patterns
Test logging with sample scripts

通过组策略（GPO）启用脚本块日志记录
为关键模块启用模块日志记录
将转录日志配置到安全存储位置
设置受保护的事件日志转发
为可疑行为模式创建告警
使用示例脚本测试日志功能

2. JEA Configuration

2. JEA配置

Define role capabilities file
Specify allowed cmdlets and parameters
Create session configuration
Register JEA endpoint
Test with limited user account
Document role assignments

定义角色能力文件
指定允许的cmdlet与参数
创建会话配置
注册JEA端点
使用受限用户账户进行测试
记录角色分配情况

3. Constrained Language Mode

3. Constrained Language Mode配置

Assess application requirements
Create AppLocker/WDAC policy
Enable CLM for untrusted scripts
Whitelist required scripts
Test application functionality
Monitor for bypass attempts

评估应用程序需求
创建AppLocker/WDAC策略
为不受信任的脚本启用Constrained Language Mode
将必要脚本加入白名单
测试应用程序功能
监控绕过尝试

Best Practices

最佳实践

Enable script block logging on all systems
Use JEA instead of full admin rights
Store credentials in secure vault (not scripts)
Apply AMSI for malware detection
Use signed scripts with AllSigned policy
Regularly audit PowerShell usage logs

在所有系统上启用脚本块日志记录
使用JEA替代完全管理员权限
将凭据存储在安全密钥库中（而非脚本内）
应用AMSI进行恶意软件检测
使用AllSigned策略运行已签名脚本
定期审计PowerShell使用日志

Anti-Patterns

反模式

Anti-Pattern	Problem	Correct Approach
Credentials in scripts	Exposure risk	SecretManagement vault
Disabled logging	No visibility	Enable all logging
Bypass execution policy	Security theater	AppLocker/WDAC
Full admin for automation	Over-privileged	JEA with minimal rights
Ignoring AMSI	Malware blind spot	Keep AMSI enabled

反模式	问题	正确做法
脚本中存储凭据	凭据泄露风险	使用SecretManagement密钥库
禁用日志记录	无安全可见性	启用全部日志功能
绕过执行策略	安全形同虚设	使用AppLocker/WDAC
自动化使用完全管理员权限	权限过度授予	使用最小权限的JEA
忽略AMSI	恶意软件检测盲区	保持AMSI启用状态