Pinned Loading

1. hAcKtive-Directory-Forensics hAcKtive-Directory-Forensics Public

   45 6

2. Get-RemotePSSession Get-RemotePSSession Public

   Query PS Sessions/WS-Man for their connected users, IPs, hosts, session times and more, for local and remote sessions, both Windows PowerShell and pwsh

   PowerShell 9 3

3. Get-UserSession Get-UserSession Public

   Query user sessions for the entire domain (Interactive/RDP etc), allowing you to query a Username and see all their logged on sessions, whether Active or Disconnected

   PowerShell 87 8

4. Invoke-AdminSDHolderPermissionCheck Invoke-AdminSDHolderPermissionCheck Public

   Analyzes AdminSDHolder permissions & compares with a previous run, to detect potential backdoor/excessive persistent permission(s)

   PowerShell 14 2

5. AD-Replication-Metadata AD-Replication-Metadata Public

   Track past changes in your AD accounts (users & computers), even if no event logs exist - e.g. not collected, no retention/overwritten, wiped (e.g. during an Incident Response) etc. Uses Replicatio…

   PowerShell 12 1

6. SEC-T_21-One-Liners-Powershell SEC-T_21-One-Liners-Powershell Public

   Code & other materials from SEC-T 2022 talk "When SysAdmin & Hacker Unite: 21 One-Liners to make you convert from bash to Powershell"

   PowerShell 17 3