Overview
The PowerShell command enumerates PowerShell installation details and security configurations. This includes PowerShell versions, execution policies, transcription settings, script block logging, and module logging - all critical for understanding PowerShell-based detection capabilities.Syntax
Remote Execution
Output
Returns PowerShell configuration:- PowerShell versions (v2.0, v5.x, v7.x)
- Execution policy settings
- Transcription configuration
- Script block logging status
- Module logging settings
- CLR versions
Use Cases
- Red Team
- Blue Team
- Determine PowerShell logging capabilities
- Check if script block logging is enabled
- Identify execution policy restrictions
- Assess PowerShell v2 availability (downgrade attacks)
- Plan obfuscation requirements
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - reads PowerShell registry configuration.
Related Commands
- PSSessionSettings - PowerShell remoting configuration
- AuditPolicies - Audit policy settings
- WindowsEventForwarding - Event forwarding configuration
- Sysmon - Sysmon configuration