Skip to content

Commit dbc0a96

Browse files
authored
Create README.md
1 parent 20e937a commit dbc0a96

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

README.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# InsecurePowerShellHost
2+
3+
InsecurePowerShellHost is a .NET Core host process for [InsecurePowerShell](https://github.com/cobbr/InsecurePowerShell), a version of PowerShell Core with key security features removed.
4+
5+
## InsecurePowerShell
6+
7+
InsecurePowershell is a fork of PowerShell Core v6.0.0, with key security features removed. InsecurePowerShell removes the following security features from PowerShell:
8+
9+
* AMSI - `InsecurePowerShell` does not submit any PowerShell code to the AMSI, even when there is an actively listening AntiMalware Provider.
10+
* PowerShell Logging - `InsecurePowerShell` disables ScriptBlockLogging, Module Logging, and Transcription Logging. Even if they are enabled in Group Policy, these settings are ignored.
11+
* LanguageModes - `InsecurePowerShell` always runs PowerShell code in `FullLanguage` mode. Attempting to set `InsecurePowerShell` to alternative LanguageModes, such as `ConstrainedLanguage` mode or `RestrictedLanguage` mode does not take any affect.
12+
* ETW - `InsecurePowerShell` does not utilize ETW (Event Tracing for Windows).
13+
14+
More details are available [here](https://cobbr.io).

0 commit comments

Comments
 (0)