Pinned Loading

1. hAcKtive-Directory-Forensics hAcKtive-Directory-Forensics Public

   54 9

2. Get-RemotePSSession Get-RemotePSSession Public

   Query PS Sessions/WS-Man for their connected users, IPs, hosts, session times and more, for local and remote sessions, both Windows PowerShell and pwsh

   PowerShell 11 3

3. WindowsMemoryThreatAnalysis WindowsMemoryThreatAnalysis Public

   Comprehensive memory threat analysis for process memory regions. Scan process(es) for suspicious patterns (protection+hex/strings), map memory regions to threads; then analyze for threats & produce…

   PowerShell 1

4. Get-LogonCount Get-LogonCount Public

   Count AD account(s) logons - Queries the logonCount attribute from all domain controllers (RWDC + RODC) for all or specific user accounts (and optionally computer accounts), with additional statist…

   PowerShell 3

5. SEC-T_21-One-Liners-Powershell SEC-T_21-One-Liners-Powershell Public

   Code & other materials from SEC-T 2022 talk "When SysAdmin & Hacker Unite: 21 One-Liners to make you convert from bash to Powershell"

   PowerShell 16 3

6. Get-UserSession Get-UserSession Public

   Query user sessions for the entire domain (Interactive/RDP etc), allowing you to query a Username and see all their logged on sessions, whether Active or Disconnected

   PowerShell 92 8