Jump to content

Disable PowerShell?


andrewek
 Share

Recommended Posts

Hello all!

The EmsiSoft blog https://blog.emsisoft.com/2017/11/17/fileless-malware-attacks/

informs about fileless Malvare. And that more often in the Windows registry they hit Windows PowerShell and WMI.

It is recommended that you turn off PowerShell.

But I do not understand how to do this? From the above instructions, it is unclear ...

In my computer(Windows 7x64), I do not find the ability to disable this application:huh:

Just launch it as a command line!

Please tell us more about the disable PowerShell!

2017-11-20 20_29_50-Fileless malware_ Invisible threat or scaremongering_ _ Emsisoft _ Security Blog.jpg

  • Upvote 1
Link to comment
Share on other sites

Whenn you go to the Control Panel screen which lists installed programs - called "Add/remove programs" on XP and "Programs & Features" on later versions of Windows, you should see a list of applications you installed and probably that's all you're used to looking at there.  But as well as that, there should be an entry at the top left that lets you change which Windows features are enabled.  PowerShell isn't in the list of ordinary installed applications, but as it's a Windows feature, it can be turned off using the option at the top left. 

Does that help?  If not maybe you could post a screenshot of what your "Programs & Features" panel looks like?

Link to comment
Share on other sites

Yes, that's the right place.   If PowerShell isn't listed (I can't read the cyrillic parts of your screenshot), maybe it's not actually been installed?   According to 

https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/07/how-do-i-install-powershell-on-windows-7-and-other-questions/

PowerShell, if you have it, will have shortcuts at  Start / All Programs / Accessories / Windows PowerShell.    Do you have those?

Link to comment
Share on other sites

PowerShell comes installed by default on Windows 7, Windows 8, Windows 8.1, and Windows 10 (in fact it has superseded the Command Prompt on Windows 10).

In theory it could have already been uninstalled, or the name in the list is in Russian and possibly doesn't translate as expected.

Link to comment
Share on other sites

6 hours ago, JeremyNicoll said:

Whenn you go to the Control Panel screen which lists installed programs - called "Add/remove programs" on XP and "Programs & Features" on later versions of Windows, you should see a list of applications you installed and probably that's all you're used to looking at there.  But as well as that, there should be an entry at the top left that lets you change which Windows features are enabled.  PowerShell isn't in the list of ordinary installed applications, but as it's a Windows feature, it can be turned off using the option at the top left. 

Does that help?  If not maybe you could post a screenshot of what your "Programs & Features" panel looks like?

Windows 7 doesn't list it in programs and features or in turn features off or on.I do have it in windows accessories .

Link to comment
Share on other sites

5 hours ago, JeremyNicoll said:

Yes, that's the right place.   If PowerShell isn't listed (I can't read the cyrillic parts of your screenshot), maybe it's not actually been installed?   According to 

https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/07/how-do-i-install-powershell-on-windows-7-and-other-questions/

PowerShell, if you have it, will have shortcuts at  Start / All Programs / Accessories / Windows PowerShell.    Do you have those?

Yes, in the list of programs, as you indicated, have the PowerShell.

Link to comment
Share on other sites

Hmm.  A bit more googling looking for explicit instructions on how to remove Powershell from win 7 suggests it's not really possible.  Some posts suggest things like removing registry keys (which I suppose might make Windows think it's not there, but it still will be).   I've also seen suggestions that uninstalling "windows management framework 5.0" might remove PowerShell as well.  But I have no idea if that is true nor whether it's a good idea.

 

I see that @Umbra has said (in comments on the oroginal blog entry) that there's W7 advice on the net.  Perhaps he could say which advice is the right advice... and if there's disadvantages to following it?

Link to comment
Share on other sites

There doesn't appear to be a way to uninstall PowerShell in Windows 7. You might be able to create an Application Rule in Emsisoft Anti-Malware to block PowerShell from running though.

On my Windows 7 computer it looks like PowerShell can run out of the following locations:

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
Link to comment
Share on other sites

1 hour ago, GT500 said:

There doesn't appear to be a way to uninstall PowerShell in Windows 7. You might be able to create an Application Rule in Emsisoft Anti-Malware to block PowerShell from running though.

On my Windows 7 computer it looks like PowerShell can run out of the following locations:

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

Thanks GT500, I blocked them all.

I have read that windows 7 needs powershell for other functions?

I'll see what happens

Thanks again!

Link to comment
Share on other sites

Powershell is a tough bird.  I've got the same four powershell exe's blocked, but that won't stop it.   Won't break anything for most users,  but  won't block it.   There is also a DLL  system.managament.autmation.dll  that  can fire off Powershell.   Not sure extactly w here in windows it, I've got it blocked with wildcards. 

I've done a lot homework on powershell malware and there are two bottom lines.

 

1.  If some can get the right script on your computer and it runs, it's game over.  They own you.

2.  The good news, is all of these infections were delivered by  email, so if you good email control your are safe

  • Like 1
Link to comment
Share on other sites

1 hour ago, Umbra said:

system.management.automation.dll  is the one to block if you worry about powershell-based exploits. 

How is this entered into a rule? I found it in C:\Windows\winsxs\msil_system.management.automation.........

Edit....Entered entire address emsisoft says file doesn't exist

 

Thanks

Link to comment
Share on other sites

Does one need to disable Powershell completely? And is this even desirable or possible on Windows versions greater than 7? On my Windows 7 machine, I started a Powershell console w/administrative privileges and ran

Set-Execution-Policy -Scope LocalMachine Restricted

which disables running PowerShell scripts execution in any context. Individual Powershell commands are still allowed, of course, so Powershell-powered malware hasn't been entirely neutered, but this is a significant protection I think.

  • Like 1
Link to comment
Share on other sites

  • 4 weeks later...

@Peter2150

1- by restricting users to use it  via Group policy 

https://community.spiceworks.com/topic/1183987-disabling-powershell-with-group-policy

2- via SRP, blocking:

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
  • system.management.automation.dll

3- by uninstalling it

windows/forum/windows_7-performance/how-to-uninstall-powershell-windows-7/c7077177-294d-4aed-8307-a1a554a56ae5?auth=1

 

i usually just do step 2, good enough for me.

 

Link to comment
Share on other sites

Yes because Powershell isn't dangerous by itself, and is needed sometimes by the system reason why you can't remove it (only the old version can); not saying on Win10, it will replace cmd very soon.

So since the old v2 is vulnerable and often used as an attack vector, disabling its execution is enough.

  • Upvote 1
Link to comment
Share on other sites

On 12/25/2017 at 7:07 PM, Umbra said:

@Peter2150

1- by restricting users to use it  via Group policy 

https://community.spiceworks.com/topic/1183987-disabling-powershell-with-group-policy

2- via SRP, blocking:

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
  • system.management.automation.dll

3- by uninstalling it

windows/forum/windows_7-performance/how-to-uninstall-powershell-windows-7/c7077177-294d-4aed-8307-a1a554a56ae5?auth=1

 

i usually just do step 2, good enough for me.

 

Just curious why is step 2 considered a srp? Because a password is required to change it?

Link to comment
Share on other sites

38 minutes ago, JeremyNicoll said:

> Just curious why is step 2 considered a srp? Because a password is required to change it?

I think SRP is 'Software Restriction Policy' - as described eg at: https://technet.microsoft.com/en-gb/library/bb457006.aspx  - is that what you think it means?

I thought it meant Secure password based authentication, must of been a typo in my google search,  your def makes much more sense.

Thanks again for answering my stupid questions Jeremy:D

Link to comment
Share on other sites

5 hours ago, JeremyNicoll said:

> Just curious why is step 2 considered a srp? Because a password is required to change it?

I think SRP is 'Software Restriction Policy' - as described eg at: https://technet.microsoft.com/en-gb/library/bb457006.aspx  - is that what you think it means?

SRP is indeed Software Restriction Policy, like Windows' Applocker (available in pro version) and some other 3rd party softs.

Step 2 can be done with any default-deny type of softs (those allowing you to select a executable and block it from running) , EAM can block them too. 

Link to comment
Share on other sites

  • 1 year later...

Hello All!

Last year, the issue of Filelles malware was discussed, and disabling Windows PowerShell was recommended as one of the protection methods.

https://blog.emsisoft.com/en/29070/fileless-malware-attacks/

Obviously, PowerShell itself is not dangerous. Dangerous scripts that she can use.
 
And as it is today, when Windows 10 is actively coming and using PowerShell, it is obvious that you will ever have to (I read that it can even replace cmd>) - what should you do today, do you need to disable and / or block PowerShell (for example, through settings Emsisoft Behavioral Blocker)?
 

 

Link to comment
Share on other sites

  • 2 weeks later...

PowerShell has a built-in permissions system these days that automatically prevents execution of downloaded scripts. This of course does not prevent an application (or a batch file) from executing PowerShell commands from the command line, so it does not negate all of the dangers of PowerShell, however I don't think this is quite as common as it was when we made that recommendation and it certainly is better understood and detected now than it was back then.

  • Like 1
Link to comment
Share on other sites

No, the screenshots are fine.    You asked " ... to remove from the settings of the EAM Behavior Blocker what has been proposed and how" ...

I think that if that is possible, it should be something that Emsi tell you how to do, but they should not change BB so that other people don't see the BB messages.   Other people, and certainly me, will want to know if powershell has been disabled IF IT WASN'T DONE BY THEM.

 

Link to comment
Share on other sites

@andrey

Есть немало шифровальщиков, которые используют Windows PowerShell для атаки и успешно осуществляют её в массовом порядке. В том числе до сих пор живо целое их поколение, которое или так и называется PowerShell Locker Ransomware или приобретает новые имена (типа этого) и ЭТО до сих периодические распространяется, когда у криптонариков набрутенные баксы перестают им петь романсы. 
Если бы этой функции не было в составе Windows, то им пришлось бы внедрять что-то подобное, чтобы осуществить эту атаку, вот тут поведенческий анализ и дал бы им жару. 
Если вы сами никогда не пользуетесь Windows PowerShell то отключите эту горе-фичу от греха подальше. 

  • Like 1
Link to comment
Share on other sites

I understand that you (somehow) disabled Powershell, and you know you did that.

Earlier you asked for a way for BB not to tell you (that Powershell is disabled).   If Emsisoft change EAM so that no user sees these messages then that is dangerous for people whose Powershell has been tampered with.   I don't care if there's a way for just you not to see the messages, but I don't think other EAM users should lose the information.

Link to comment
Share on other sites

20 hours ago, andrey said:

Do you think it is possible to remove from the settings of the EAM Behavior Blocker what has been proposed and how?

Edit the rules and change them to "Monitored".

Although, feel free to follow Amigo-A's advise, and keep PowerShell blocked if you'd like.

  • Upvote 1
Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...