Cheat Sheet

Investigating With PowerShell

#REMOVE WMI PERSISTENCE
pwsh -command "Get-WMIObject -Namespace root\Subscription -Class __EventFilter -Filter \"Name='SCM Event4 Log Filter'\" | Remove-WmiObject"

#remove namespace
Get-WmiObject -Namespace root\Default -List | where {$_.Name -match 'systemcore_Updater?'}

#Recursive shortcut lookup with expansion.
pwsh $lnk = gci -Path 'C:\FILEPATH' *.lnk -Recurse -ErrorAction SilentlyContinue -Force | select -exp Fullname ; ForEach ($lnk in $lnk) {$sh = New-Object -COM WScript.Shell ; $targetPath = $sh.CreateShortcut($lnk) ; $targetPath}

#ECKING DOWNLOADS DIRECTORY FOR FILE HASH.
Get-ChildItem -Path C:\Users\ -Filter *.exe -Recurse -ErrorAction SilentlyContinue -Force | Get-FileHash | Where-Object {$_.Hash -eq 'be3fc53bdc3a68eb2150f62a96b30ec9efbc2f99e6166a6a737a00467cdf1f08'}

#DISPLAY DISK NAMES
Get-Disk | % {$_.FriendlyName}

#ADS
pwsh Get-Item FILEPATH* -Stream zone* | cat
pwsh Get-Item .\a.zip -Stream *
pwsh Get-Content .\a.zip -Stream Zone.Identifier
pwsh wmic process get 'processid,parentprocessid'

#Show Original Recycle.Bin Names
pwsh (New-Object -ComObject Shell.Application).NameSpace(0x0a).Items() | select @{n="OriginalLocation"; e={$_.ExtendedProperty("{9B174B33-40FF-11D2-A27E-00C04FC30871} 2")}},Name

#SHOW DATE
pwsh get-date

#IIS vs Apache

#FIND SHARE DRIVES
net share

#Svchost Service Names
tasklist /svc /fi "imagename eq svchost.exe"

#Read Windows Logs
cat '\inetpub\logs\LogFiles\w3svc1\u_ex221006.log' | sls 'MDEDiscovery' | out-string

#SORT LAST WRITE TIME
pwsh gci 'C:\Users\USERNAME\Downloads\*' | sort lastwritetime

#FIND NETWORK SHARE ON HOST
pwsh cmd.exe /c net share

#GET SCHEDULED TASK INFO
pwsh Export-ScheduledTask -TaskName 'TaskName'

#SechuledTask Removal
pwsh schtasks /delete /tn '<schduledtaskname>' /F

#Remove Registry Key/Property
reg delete "<Registry Location>" <property value>

#DELETE ALL FILES IN A FOLDER+SUBFOLDERS
Get-ChildItem -Path 'C:\Exmaple' -Include *.* -File -Recurse | foreach { $_.Delete()}

#GET PROCESS USING DLL
pwsh get-process | Where {$_.Modules -like '*CloverSvc.dll'}

#IDENTIFY MOUNTED DRIVES
pwsh Get-WmiObject -Class Win32_logicaldisk

#IDENTIFY LOCATION OF MOUNTED FILE
pwsh Get-DiskImage -DevicePath \\.\CDROM0

#UNMOUNTING FILE
pwsh Dismount-DiskImage -ImagePath 'PATH_TO_ISO'

#FIND FILE NAME WITH FULL PATH INCLUDED IN USERS
pwsh Get-ChildItem -Path C:\Users -Filter *FILEPATH* -Recurse -ErrorAction SilentlyContinue -Force | select -exp Fullname

##Take Ownership of File
takeown /F FILEPATH
icacls FILEPATH /grant Administrators:F;

#list running proccesses and thier commandline
pwsh wmic process get processid,commandline

##LIST USBS
Get-PnpDevice -PresentOnly | Where-Object { $_. InstanceId -match '^USB'
wmic path CIM_LogicalDevice where "Description like 'USB%'" get /value

#See History of Devices Plugge in
pnputil /enum-devices
pnputil /enum-interfaces

#
Q3Jvd2QkdHJpa2VFbmNyeXB0c0ZpbEVuY3J5cHQzZCE=

#New Service was Installed
pwsh Get-WinEvent –Logname 'System' -MaxEvents 10 -FilterXPath '*[System[EventID=7045]]' | FL TimeCreated,Message

#User Logon
pwsh Get-WinEvent –Logname 'Security' -MaxEvents 10 -FilterXPath '*[System[EventID=4624]]' | FL TimeCreated,Message

#Event Logs
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4624'; Data='3'} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id='4672';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id='4103';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id='4104';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-PowerShell/Operational'; Id='53504';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Windows PowerShell'; Id='400';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Windows PowerShell'; Id='403';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM/Operational'; Id='91';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-WinRM/Operational'; Id='168';} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Application'; Id='326'} | FL TimeCreated,Message
Get-WinEvent -FilterHashtable @{ LogName='Application'; Id='327'} | FL TimeCreated,Message

#Exchange ProxyShell
pwsh Get-WinEvent -FilterHashtable @{LogName='MSExchange Management';} | ? {$_.Message -match 'aspx'} | FL TimeCreated, Message | Out-String

#ANDROMEDA
pwsh Get-Item -LiteralPath D:\$([char]0xA0)\ -Force
Get-Item -LiteralPath E:\$([char]0xA0)\ -Force | Rename-Item -NewName 'FOR_REVIEW_RenamedFolder' -Force

#Show full Target Path for all .lnk
$WSShell = New-Object -ComObject Wscript.Shell
$shortcutfiles = dir .\*.lnk
foreach ($shortcutfile in $shortcutfiles ) {
    $Shortcut = $WSShell.CreateShortcut($shortcutfile.FullName)
    Write-Host $Shortcutfile.Name $Shortcut.TargetPath $shortcut.Arguments
}

##Display a list of path exceptions for Windows Defender:
Get-MpPreference | fl excl*

##To remove an exception for a specific folder:
Remove-MpPreference -ExclusionPath C:\install

##Check last bootup time
pwsh Get-WmiObject -Class win32_operatingsystem -Property LastBootUpTime

##PWSH sort processes
pwsh get-process | where {$_.path -like '*ProgramData*'} | select ProcessName

#Hash of unsigned or invalid signed DLLs currently loaded by processes
pwsh $A=$(foreach ($dll in gps|select -ExpandProperty modules -ea ig){Get-AuthenticodeSignature $dll.FileName |Where-Object Status -NE "Valid"|Select Path});$B=$(foreach ($dll in $A){Get-FileHash $dll.Path| select Hash -ExpandProperty Hash})|Sort-Object| Get-Unique;$B


#List all IIS websites with physical paths and binds
#IIS logs are located in C:\Inet\logs\logfiles\W3SVC2 if ID is 2
#IIS logs:
C:\inetpub\logs\LogFiles\W3SVC<instanceIDnumber>\
#find instance ID number:
pwsh Import-Module Webadministration;Get-Website|out-string

#Software Version with WMI
wmic datafile where 'name="C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"'

#LIST EVERY \Device\Harddiskvolume.?
$signature = @'
[DllImport("kernel32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetVolumePathNamesForVolumeNameW([MarshalAs(UnmanagedType.LPWStr)] string lpszVolumeName,
        [MarshalAs(UnmanagedType.LPWStr)] [Out] StringBuilder lpszVolumeNamePaths, uint cchBuferLength,
        ref UInt32 lpcchReturnLength);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr FindFirstVolume([Out] StringBuilder lpszVolumeName,
   uint cchBufferLength);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool FindNextVolume(IntPtr hFindVolume, [Out] StringBuilder lpszVolumeName, uint cchBufferLength);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern uint QueryDosDevice(string lpDeviceName, StringBuilder lpTargetPath, int ucchMax);

'@;
Add-Type -MemberDefinition $signature -Name Win32Utils -Namespace PInvoke -Using PInvoke,System.Text;

[UInt32] $lpcchReturnLength = 0;
[UInt32] $Max = 65535
$sbVolumeName = New-Object System.Text.StringBuilder($Max, $Max)
$sbPathName = New-Object System.Text.StringBuilder($Max, $Max)
$sbMountPoint = New-Object System.Text.StringBuilder($Max, $Max)
[IntPtr] $volumeHandle = [PInvoke.Win32Utils]::FindFirstVolume($sbVolumeName, $Max)
do {
    $volume = $sbVolumeName.toString()
    $unused = [PInvoke.Win32Utils]::GetVolumePathNamesForVolumeNameW($volume, $sbMountPoint, $Max, [Ref] $lpcchReturnLength);
    $ReturnLength = [PInvoke.Win32Utils]::QueryDosDevice($volume.Substring(4, $volume.Length - 1 - 4), $sbPathName, [UInt32] $Max);
    if ($ReturnLength) {
           $DriveMapping = @{
               DriveLetter = $sbMountPoint.toString()
               VolumeName = $volume
               DevicePath = $sbPathName.ToString()
           }

           Write-Output (New-Object PSObject -Property $DriveMapping)
       }
       else {
           Write-Output "No mountpoint found for: " + $volume
       }
} while ([PInvoke.Win32Utils]::FindNextVolume([IntPtr] $volumeHandle, $sbVolumeName, $Max));



#DLL SEARCH
$files = (get-process lsass).modules
$results = @()
ForEach ($f in $files)
    {
        $file = ls -path $f.FileName
        $authenticode = Get-AuthenticodeSignature -FilePath $file.FullName -ErrorAction SilentlyContinue
        $sha256 = Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Hash
        $NameMatch = $false
        if($file.Name -like $file.VersionInfo.OriginalFilename) { $NameMatch = $true }
        $PSObjectRow = New-Object PSObject -Property @{
            FullName                = $file.FullName
            Size                    = $file.Length
            CreationTimeUtc         = $file.CreationTimeUtc
            LastAccessTimeUtc       = $file.LastAccessTimeUtc
            LastWriteTimeUtc        = $file.LastWriteTimeUtc
            Sha256                  = $sha256
            OriginalFilename        = $file.VersionInfo.OriginalFilename
            NameMatch               = $NameMatch
            CompanyName             = $file.VersionInfo.CompanyName
            FileDescription         = $file.VersionInfo.FileDescription
            AuthenticodeStatus      = $authenticode.Status
            AuthenticodePath        = $authenticode.Path
            AuthenticodeSigType     = $authenticode.SignatureType
            AuthenticodeIsOSbinary  = $authenticode.IsOSBinary
        }
        $results += $PSObjectRow
    }
$results | Select-Object FullName, OriginalFilename, NameMatch, FileDescription, CompanyName, Size, Sha256, CreationTimeUtc, LastAccessTimeUtc, LastWriteTimeUtc, AuthenticodeStatus, AuthenticodeSigType, AuthenticodeIsOSbinary | Out-String -width 1000


#TRIAGE SCRIPT TEMPLATE
function triage {
    $fileArray = checkFiles
    echo '';
    echo '------------------------------';
    echo 'File System Artifacts Found:';
    echo '------------------------------';
    if ($fileArray){
        foreach($file in $fileArray){
            echo "[-] $file"
        }
    }
    else {echo '[-] No Files Found'}

}

function checkFiles{
    $fileList = New-Object System.Collections.ArrayList
    $badDirs = @('C:\PerfLogs\rundll32.exe', 'c:\users\*\downloads\scaler.exe', 'c:\users\public\downloads\gst2.exe', 'c:\users\public\downloads\*.exe', 'C:\windows\temp\winsys.mdp', 'C:\windows\temp\winsys.zip', 'C:\Users\Public\svcss.csv', 'C:\Temp\1.bat', 'C:\Temp\*.bat', 'C:\temp\2.bat', 'C:\Users\*\*\mimikatz.exe', 'C:\Users\*\*\mimilib.dll', 'C:\Users\*\*\mimidrv.sys', 'C:\Users\*\*\mimikatz-master.zip', 'C:\Users\*\*\1', 'C:\Users\Public\gsc3.exe', 'C:\Users\Public\*.exe')

    foreach ($badDir in $badDirs){
        if (Test-Path $badDir) {
            $dirPath = get-item $badDir
            [void]$fileList.add($dirPath)
        }
    }
    return $fileList
}

triage;

Linux

Splunk

PreviousExample PageNextRed Team:

Last updated