The first step to make Powershell more secure is to create a certificate to sign my scripts. Then you actually sign it with this command:
Set-AuthenticodeSignature -FilePath myScript.ps1 -Certificate (Get-ChildItem -Path Cert:\CurrentUser\My\ -CodeSigningCert)
What creates a bit of a headache for me, is that you don't even need to specify the name of the certificate, it is chosen automatically.
Let's say somehow the password of the user owning that certificate get's leaked or a program somehow gains entry into that account. How do I prevent someone from using PowerShell to just sign their own, malicious script, to attack my infrastructure?
For example, by executing this on the command shell:
powershell /command Set-AuthenticodeSignature -FilePath .\myScript.ps1 -Certificate (Get-ChildItem -Path Cert:\CurrentUser\My\ -CodeSigningCert)
I have also studied the
New-SelfSignedCertificate command and I do not find any indication that the certificate itself can be protected by a password or similar mechanics. What am I overlooking here?