powershell-security-hardening
26
总安装量
26
周安装量
#7638
全站排名
安装命令
npx skills add https://github.com/404kidwiz/claude-supercode-skills --skill powershell-security-hardening
Agent 安装分布
claude-code
20
opencode
19
gemini-cli
17
cursor
15
windsurf
13
Skill 文档
PowerShell Security Hardening
Purpose
Provides expertise in Windows security hardening and PowerShell security configuration. Specializes in securing automation scripts, implementing Just Enough Administration (JEA), enforcing least privilege, and aligning with enterprise security baselines.
When to Use
- Configuring PowerShell security policies
- Implementing Constrained Language Mode
- Setting up Just Enough Administration (JEA)
- Enabling PowerShell logging and auditing
- Securing automation credentials
- Applying CIS/STIG baselines
- Protecting against PowerShell attacks
- Implementing execution policies
Quick Start
Invoke this skill when:
- Hardening PowerShell environments
- Implementing JEA or constrained language mode
- Configuring PowerShell logging
- Securing automation credentials
- Applying security baselines
Do NOT invoke when:
- General Windows administration â use
/windows-infra-admin - PowerShell development â use
/powershell-7-expert - Active Directory security â use
/ad-security-reviewer - Network security â use
/network-engineer
Decision Framework
Security Requirement?
âââ Script Execution Control
â âââ Basic â Execution Policy
â âââ Strict â AppLocker/WDAC
âââ Language Restriction
â âââ Constrained Language Mode
âââ Privilege Reduction
â âââ JEA (Just Enough Administration)
âââ Auditing
âââ Script Block Logging + Transcription
Core Workflows
1. PowerShell Logging Setup
- Enable Script Block Logging via GPO
- Enable Module Logging for key modules
- Configure transcription to secure location
- Set up protected event log forwarding
- Create alerts for suspicious patterns
- Test logging with sample scripts
2. JEA Configuration
- Define role capabilities file
- Specify allowed cmdlets and parameters
- Create session configuration
- Register JEA endpoint
- Test with limited user account
- Document role assignments
3. Constrained Language Mode
- Assess application requirements
- Create AppLocker/WDAC policy
- Enable CLM for untrusted scripts
- Whitelist required scripts
- Test application functionality
- Monitor for bypass attempts
Best Practices
- Enable script block logging on all systems
- Use JEA instead of full admin rights
- Store credentials in secure vault (not scripts)
- Apply AMSI for malware detection
- Use signed scripts with AllSigned policy
- Regularly audit PowerShell usage logs
Anti-Patterns
| Anti-Pattern | Problem | Correct Approach |
|---|---|---|
| Credentials in scripts | Exposure risk | SecretManagement vault |
| Disabled logging | No visibility | Enable all logging |
| Bypass execution policy | Security theater | AppLocker/WDAC |
| Full admin for automation | Over-privileged | JEA with minimal rights |
| Ignoring AMSI | Malware blind spot | Keep AMSI enabled |