1.6.2 Analyzing PowerShell Commands/Scripts

Powershell commands are easy to understand compared to assembly code, but in some situations (such as when a PowerShell command is obfuscated), you may want to run the PowerShell commands to understand how it works. The easiest method to test a single command is to execute it in the interactive PowerShell. If you wish to execute a PowerShell script (.ps1) containing multiple commands, first change the execution policy setting to either Bypass or Unrestricted (as mentioned previously) and then execute the script using the PowerShell console. Remember to execute malicious script in an isolated environment.

Running the script (.ps1) in the PowerShell prompt will run all the commands at once. If you wish to have control over the execution, then you can debug the PowerShell script using PowerShell ISE (Integrated Scripting Environment). You can bring up PowerShell ISE by using the program search feature and then load the PowerShell script into PowerShell ISE or copy-paste a command and use its debugging features (such as Step Into, Step Over, Step Out, and Breakpoints) which can be accessed via the Debug menu. Before debugging, make sure to set the execution policy to Bypass:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.137.178.133