Questions tagged [powershell]

task automation and configuration management CLI for Windows, the first release was in Windows XP SP2 in 2006

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
2answers
77 views

Can a PowerShell script inside a Zip file execute automatically upon unzipping?

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I ...
1
vote
2answers
93 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
0
votes
1answer
33 views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
1
vote
0answers
78 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
1
vote
2answers
80 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
2
votes
1answer
123 views

What security implications are involved when using a CSV file to fill a SQL table?

I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers. I am using a script based on the one ...
-1
votes
1answer
40 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
0
votes
0answers
18 views

DLL's loaded for Windows To Recompile Scripts

Malware can use droppers and can break code to execute into different parts. It can recompile parts of a base64 encoded script to make the whole command. How does Windows recompile powershell scripts ...
0
votes
1answer
94 views

How do I prevent someone from using my certificate to sign a malicious script on my PC?

The first step to make Powershell more secure is to create a certificate to sign my scripts. Then you actually sign it with this command: Set-AuthenticodeSignature -FilePath myScript.ps1 -Certificate ...
1
vote
0answers
36 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
0answers
172 views

Installed a fresh copy of win10 and i have PowerShell script sending info to https://rip.rblx.dev/c/? [closed]

i saw this topic and found out i have those files as well: What is this PowerShell script sending Discord info to random server? so i installed a fresh copy that i downloaded of win10 pro from ...
1
vote
1answer
364 views

What is this PowerShell script sending Discord info to random server?

Upon turning on my personal Windows 10 computer tonight, I was greeted with ConEmu telling me that two PowerShell commands were run at startup. Both commands were the same thing: powershell -...
0
votes
2answers
113 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
0
votes
0answers
95 views

applocker script rules blocking diagnostic troubleshooter by default

My googling came up with nothing useful. I assume others must have ran into this too. If we start the Network Troubleshooter wizard it generates some temp ps1 files that are blocked silently to the ...
1
vote
0answers
224 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
0answers
181 views

Unable to write to C:\ folder when logged in through BUILTIN\Users account | Windows Privilege Escalation | Unquoted Service Path

I have made an auto-start service from user (who is only in Administrators group and not Users) command prompt which is vulnerable to Unquoted Service Path. Executable path: C:\Program Files\A ...
0
votes
1answer
27 views

Extensions and Modules and Packages, Oh My! [closed]

How do you know if extensions (e.g., Code, Chrome, Firefox), modules (e.g., PowerShell), or packages (e.g., Python, R) are not malicious? How can you control or monitor that in an environment? Stuff ...
3
votes
2answers
380 views

Did I just infect my machine?

I just ran an AVI file that was sent to me, thinking AVIs were safe. Turns out it was a windows shortcut with this in the path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd 1 ...
1
vote
1answer
36 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
4answers
182 views

why do I get an email with address of Me'.exe'

I am wondering if there is a security issue with this. I use Mozilla, and I got an email with Me, '.exe' <myemail@server.com>. I have never seen this. What is it? Is it a way to send mass email? ...
3
votes
1answer
187 views

Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script?

I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website. The download's are signed from Microsoft (although the signatures are expired by a few ...
0
votes
1answer
278 views

Is this type of encryption one-way?

I am writing a Powershell script that requires a privileged account to do something. Of course, I'm not going to include the password of this account in the .ps1 file in clear text so I am following ...
3
votes
0answers
190 views

Cortana password bypass CVE-2018-8140

Recently a vulnerability in Microsoft's Cortana (CVE2018-8140) has been patched. Mcafee made a blog post about it explaining some background information. There is also a video showing a Proof of ...
1
vote
0answers
26 views

Are the interactive methods of credential gathering listed here actually secure, since they dont store the credentials on disk?

I found an article about different ways to collect and pass credentials in powershell. The author states that some of these methods are 100% secure (which is obviously an exaderation) but for ...
1
vote
0answers
352 views

How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?

Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory amd sent ...
0
votes
3answers
5k views

How can I track executed PowerShell commands within a network?

I wanto to track PowerShell commands which are executed by users in the intranet. How can I do this? I need the user's information and their executed commands. Is it possible? Edit 1: I guess I can ...
0
votes
2answers
293 views

Have I created some kind of malware? [closed]

I am quite new to this type of stuff and I'm experimenting a little bit. This weekend I had some spare time and decided to joke around with VBScript and powershell. What I did is I wrote a VBScript ...
0
votes
2answers
230 views

Defending Against Empire

My understand of Empire is a framework that allows hackers to create listeners, and run code over the internet with the help of power shell through the use of DLL injections, Thread Injections, and ...
-1
votes
1answer
431 views

Does C# code running with PowerShell Add-Type set off anti-virus?

C# code can be included and executed in a PowerShell script using Add-Type. According to Microsoft: "Add-Type compiles the specified source code and generates an in-memory assembly that contains ...
1
vote
1answer
179 views

Give users a powershell script to run - Secure?

Is there a secure and practical way to give a group of users a powershell script to run on their laptops? The users all have active directory accounts, but their computers are not joined to any ...
-1
votes
4answers
720 views

Does a Turing complete shell means equal secure?

I have heard that Linux is more secure than Windows. Is that true? I think they are equally secure because both has a Turing complete shell so if you management to do harm on one system, there is a ...
2
votes
2answers
125 views

How do you find out if your PC is reverse shelled?

I am just wondering, how do you find out is your PC is reverse shelled or not? Does your antivirus protect against it?
4
votes
1answer
883 views

Powershell Empire - Token Impersonation

I have been struggling trying to get token impersonation to work in Empire 2.0. I use the credentials/mimitokens module to list and elevate to use a specific users token - I see mimikatz' output ...
72
votes
3answers
11k views

Strange code running at startup

A piece of code was running on my Windows machine at startup. I would like to know exactly what this code is doing; it seems to refer to something like crackbook? @echo off if %...
-2
votes
2answers
454 views

Can PowerShell be used to run scripts on a remote PC?

Can powershell be used to run scripts on remote PC’s like i am sitting in my house and i want to run scripts on a facebook server ,is that possible (if facebook server is using windows )? Question 2) ...
2
votes
1answer
118 views

Admins running Powershell from their desktop instead of server

What security issues are presented by letting server admins in a corporate environment run PowerShell scripts from their local desktop rather than from the server? I am not a server guru by any means ...
1
vote
1answer
73 views

Is it possible to export user account certificates remotely with NTLM hash authentication?

The EFS encryption uses user certificate, generated with his username and password, to encrypt the files so that only that user can access it. My question is this: Can you export user certificates ...
1
vote
1answer
74 views

Store a text in encrypted form and use in powershell script without compromising it to other users?

I want to encrypt a text which I want to use in different PowerShell script without compromising its security as other user will be using scripts that will contain that text. Basically I want to ...
4
votes
1answer
114 views

What are the proper steps for “quarantining” Malware?

I am writing a powershell script that effectively quarantines a computer after malware is detected on the system. So far I have the script disconnecting the ethernet adapters to ensure the device can'...
4
votes
1answer
1k views

Empire testing powershell commands

I am testing Empire Powershell. I was wondering how you can remotely execute a file after you upload it to the victim's machine? (Empire: ANHGP22NCFLPVAAH) > cd Desktop (Empire: ANHGP22NCFLPVAAH) ...
1
vote
1answer
133 views

In Windows, what's the difference between enumerating logged on users vs sessions?

I'm reading over PowerView.ps1, part of PowerSploit, and I'm wondering: what's the difference between sessions and logged on users? Get-NetLoggedon (which uses the NetWkstaUserEnum Win32 API call, and ...
4
votes
1answer
715 views

Where you can run shellcode inside an ordinary process, what is a stealthy way to leverage that to get offensive Powershell code running from it?

Right now, offensive use of Powershell is one the hottest topics in infosec. Powershell scripts are most often pitched as being appropriate for the "post-exploitation" phase of a penetration. This ...
5
votes
2answers
1k views

How to make Automated API calls which are at least minimally secure? [duplicate]

How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
2
votes
2answers
3k views

Missing Powershell Logging Options in Group Policy Editor

I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
0
votes
2answers
847 views

Is powershell being executed from within Javascript a security risk?

One of our clients called after getting hit by a popup and being asked to call a number. This scam tatic has been growing faster and faster in terms of calls that we get. I was curious how they knew ...
0
votes
1answer
197 views

Can I use something other than AES 128 to store my PSCredential?

From what I've read the ConvertTo-SecureString will store a password with AES-128 (which as I understand it is cracked)...is it possible to use more bits? I've read in Get-Help the following, but I ...
1
vote
0answers
136 views

Does running a PowerShell script using an embedded System.Managment.Automation DLL prevent it from being scanned by AMSI?

A new feature called Antimalware Scan Interface, that allow AVs to 'see' Powershell commands executed, was introduced in Powershell v5. According to adsecurity, this feature seems to rely on the ...
0
votes
1answer
280 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
1
vote
1answer
54 views

Is it always safe to type [i.e. run Get-Content] on a file in PowerShell?

Supposedly an attacker sends me a malicious readme.txt and I'm going to open PowerShell and run type readme.txt. Can the attacker via any sort of control char sequences or using any other technique ...