Tagged powershell

Spot PowerShell Empire traces in script block and module logs

Decode obfuscated PowerShell from script block logs in EVTX files

Deobfuscate multi-layer PowerShell malware with AST analysis and PSDecode to reveal C2

Catch fileless in-memory attacks using PowerShell, WMI and reflective DLL injection

Analyze fileless malware built on PowerShell, .NET reflection and LOLBins

Hunt encoded commands, download cradles and AMSI bypass in PowerShell telemetry

Hunt obfuscated PowerShell, AMSI bypass and encoded payloads in 4104 and 4103 logs

Hunt ransomware shadow copy deletion with vssadmin, wmic and PowerShell telemetry

Write PowerShell for Windows with correct operator syntax and error handling

Automate Microsoft 365 tenant admin with PowerShell, Conditional Access and licensing

Write PowerShell scripts for Windmill automation on Windows hosts

Run safe PowerShell commands on Windows, translate Bash snippets and fix setup issues

Run PowerShell safely with correct quoting, escaping and native program calls

Automate Windows desktop apps and work around PowerShell quoting and UIPI limits

Deliver scanners and tools to a compromised host with wget, certutil and PowerShell

Automate Windows apps and settings with PowerShell, COM and UI Automation

Administer Windows Server with IIS, Active Directory and PowerShell automation

Connect to Power BI Desktop models over PowerShell to run DAX and edit metadata