https://github.com/cobbr/insecurepowershellhost

InsecurePowerShellHost is a .NET Core host process for InsecurePowerShell, a version of PowerShell Core v6.0.0 with key security features removed.
https://github.com/cobbr/insecurepowershellhost

dotnet-core dotnet-core2 powershell powershell-core

Last synced: 3 months ago
JSON representation

InsecurePowerShellHost is a .NET Core host process for InsecurePowerShell, a version of PowerShell Core v6.0.0 with key security features removed.

• Host: GitHub
• URL: https://github.com/cobbr/insecurepowershellhost
• Owner: cobbr
• Created: 2017-12-19T03:24:19.000Z (about 7 years ago)
• Default Branch: master
• Last Pushed: 2017-12-19T03:37:52.000Z (about 7 years ago)
• Last Synced: 2024-10-11T21:01:37.218Z (3 months ago)
• Topics: dotnet-core, dotnet-core2, powershell, powershell-core
• Language: C#
• Homepage: https://cobbr.io
• Size: 3.22 MB
• Stars: 30
• Watchers: 5
• Forks: 7
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# InsecurePowerShellHost

InsecurePowerShellHost is a .NET Core host process for [InsecurePowerShell](https://github.com/cobbr/InsecurePowerShell), a version of PowerShell Core with key security features removed.

## InsecurePowerShell

InsecurePowershell is a fork of PowerShell Core v6.0.0, with key security features removed. InsecurePowerShell removes the following security features from PowerShell:

* AMSI - `InsecurePowerShell` does not submit any PowerShell code to the AMSI, even when there is an actively listening AntiMalware Provider.

* PowerShell Logging - `InsecurePowerShell` disables ScriptBlockLogging, Module Logging, and Transcription Logging. Even if they are enabled in Group Policy, these settings are ignored.

* LanguageModes - `InsecurePowerShell` always runs PowerShell code in `FullLanguage` mode. Attempting to set `InsecurePowerShell` to alternative LanguageModes, such as `ConstrainedLanguage` mode or `RestrictedLanguage` mode does not take any affect.

* ETW - `InsecurePowerShell` does not utilize ETW (Event Tracing for Windows).

More details are available [here](https://cobbr.io).