PowerShell Obfuscation Using SecureString https://bit.ly/2p2m0x5
#infosec #security #PowerShell #malware
#infosec #security #PowerShell #malware
DbgShell - A PowerShell Front-End For The Windows Debugger Engine http://bit.ly/2O7c30o #infosec #hacking #hackers #pentesting #pentest #programming #opensource #powershell #Windows
Abusing #PowerShell Desired State Configuration for Lateral Movement
https://posts.specterops.io/abusing-powershell-desired-state-configuration-for-lateral-movement-ca42ddbe6f06
https://posts.specterops.io/abusing-powershell-desired-state-configuration-for-lateral-movement-ca42ddbe6f06
Medium
Abusing PowerShell Desired State Configuration for Lateral Movement
Lateral Movement Technique Description
Have you checked your PSReadline history lately? Do you know it stores the commands in clear-text and is persistent across reboots? This is on a Domain Controller. #PowerShell #RedTeam
A collection of infrastructure related tests for use with #Pester & #PowerShell.
https://github.com/EvotecIT/PesterInfrastructureTests
https://github.com/EvotecIT/PesterInfrastructureTests
GitHub
EvotecIT/PesterInfrastructureTests
A collection of infrastructure related tests for use with Pester & PowerShell. - EvotecIT/PesterInfrastructureTests
PowerShell Strict Mode http://bit.ly/2Cw8BXE #PowerShell
devblackops.io
PowerShell Strict Mode
Add a file/folder to #Windows Defender exclusion list
C:\>powershell -exec bypass - "Add-MpPreference -ExclusionPath 'D:\EvilFolder\Tools'"
useful if you want to move #pentest tools to a Windows machine without Defender interfering
Admin UAC prompt required
#powershell #oscp
C:\>powershell -exec bypass - "Add-MpPreference -ExclusionPath 'D:\EvilFolder\Tools'"
useful if you want to move #pentest tools to a Windows machine without Defender interfering
Admin UAC prompt required
#powershell #oscp
#Powershell script to extract all users and last logon timestamp from a domain
https://gallery.technet.microsoft.com/scriptcenter/Powershell-script-to-398c5aab
https://gallery.technet.microsoft.com/scriptcenter/Powershell-script-to-398c5aab