Pinned Loading

1. Get-UserSession Get-UserSession Public

   Query user sessions for the entire domain (Interactive/RDP etc), allowing you to query a Username and see all their logged on sessions, whether Active or Disconnected

   PowerShell 95 9

2. hAcKtive-Directory-Forensics hAcKtive-Directory-Forensics Public

   53 9

3. ProtectedFile ProtectedFile Public

   Protect/Unprotect any file (PE files, .ps1, etc.) by compressing & Encrypting content using AES 256 & gzip, and a cipher base64. uses random salt, KDF -> key+IV, and prepends salt to ciphertext. Ca…

   PowerShell 5 1

4. Get-HypervisorHosts Get-HypervisorHosts Public

   Detects if host(s) are running common Hypervisors (e.g. Hyper-V, VMware, VirtualBox, WSL etc.) to assist hunt for attackers carrying out tasks from VM without logging, AV or EDR monitoring

   PowerShell 4

5. Get-AdminSDHolder Get-AdminSDHolder Public

   Analyze effective protected groups in AD, honoring dsHeuristics. Outputs to Console, CSV and DOT (creates a Visual Map using graphviz)

   PowerShell 8 2

6. SEC-T_21-One-Liners-Powershell SEC-T_21-One-Liners-Powershell Public

   Code & other materials from SEC-T 2022 talk "When SysAdmin & Hacker Unite: 21 One-Liners to make you convert from bash to Powershell"

   PowerShell 16 3