Pinned Loading

1. hAcKtive-Directory-Forensics hAcKtive-Directory-Forensics Public

   49 7

2. Get-UserSession Get-UserSession Public

   Query user sessions for the entire domain (Interactive/RDP etc), allowing you to query a Username and see all their logged on sessions, whether Active or Disconnected

   PowerShell 90 9

3. Search-StringInAD Search-StringInAD Public

   Looks recursively for 'interesting' strings (as well as IP addresses & hidden Unicode characters) in all AD objects

   PowerShell 2

4. Get-RemotePSSession Get-RemotePSSession Public

   Query PS Sessions/WS-Man for their connected users, IPs, hosts, session times and more, for local and remote sessions, both Windows PowerShell and pwsh

   PowerShell 10 3

5. Get-WMIPermissionAnomaly Get-WMIPermissionAnomaly Public

   Hunt for anomalies, excessive permissions & potential backdoors in WMI namepaces

   PowerShell 3

6. SEC-T_21-One-Liners-Powershell SEC-T_21-One-Liners-Powershell Public

   Code & other materials from SEC-T 2022 talk "When SysAdmin & Hacker Unite: 21 One-Liners to make you convert from bash to Powershell"

   PowerShell 17 3