Keep Calm and Recover - Matthew Hitchcock - PSConfEU 2023
Channel: PowerShell Conference EU
Date: 2023-07-19

In this session , I,Matthew Hitchcock, discuss the recovery process in response to a cyber attack and bringing large environments back online. Our team's primary goals are proactive controls to limit the impact of attacks and a remediation team to assist with security incidents. Most attacks and compromises occur on Windows environments, so we spend a lot of time cleaning that up. We work primarily on APT attacks, where attackers try to remain undetected, and ransomware attacks, which are more obvious and disruptive.

The recovery process for APT or ransomware attacks can take about four weeks. We emphasize the use of PowerShell to help expedite the recovery process. It is important to interrupt the attack life cycle and implement core controls during the recovery. Disabling PowerShell is not recommended, as it is a valuable tool for completing the recovery tasks efficiently. We discuss the importance of using the Windows firewall to secure access and control PowerShell usage. Turning on the Windows Firewall during the recovery process is highly recommended.

Attacks that use PowerShell typically involve reaching out to the web or another IP to download and execute malicious code. We suggest using AD policies to limit PowerShell's communication capabilities instead of disabling it entirely. By configuring the Windows Firewall, we can easily limit the communication of PowerShell. This allows us to control where PowerShell can communicate, such as the local subnet, the internet, or specific IP addresses. Predefined networks in the firewall rules can restrict PowerShell from accessing the internet while still allowing internal communication, preventing attackers from downloading malicious content on our systems.

We can also utilize IPsec controls to authenticate connections to PowerShell from remote machines. By limiting which accounts and computers can connect to PowerShell using IPsec, we add an extra layer of security against unauthorized access. This is especially important during a recovery scenario when we are trying to regain control of our environment. Creating a connection security rule in IPsec ensures that the endpoints authenticate each other before establishing a connection. This allows us to selectively open up access to PowerShell only for authorized users by adding our newly created accounts and recovery machines to the allowed list. Even if an attacker compromises those credentials, they would still need to access an authorized machine to continue their actions.

During the recovery phase, it is advisable to perform remote work as much as possible to minimize the risk of new credentials being stolen. Logging in over Remote Desktop Protocol (RDP) is not recommended during this period, as we may not yet fully trust the endpoints in our environment. Instead, we should focus on deploying agents and gathering data remotely to assess the situation. Remote tools like remote PowerShell connections provide more control and security in these scenarios.

To further restrict access to tier zero accounts, such as domain controllers and accounts with domain admin rights, we can utilize authentication policies and silos. These allow us to define authentication rules and limitations, specifying who can log in and from where. This helps prevent unauthorized access and better secures valuable credentials. VPNs used to connect to the internal network should enforce multi-factor authentication (MFA) and tighten MFA enrollment processes to avoid compromise. The creation of authentication silos, which act as a protective boundary around certain accounts and machines, can be achieved using PowerShell. Authenticating connections to PowerShell and restricting authentication to only authorized users and designated servers is crucial, especially for domain controllers.