bodik / defender Goto Github PK

https://pentestlab.blog/2018/05/10/applocker-bypass-cmstp/

Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem, OperatingSystemServicePack | Format-List name, ipv4*, oper*

https://isc.sans.edu/diary.html?n&storyid=23840

C in MAC times does not stand for creation (as it corelates many times) but for 'change of attributes'

elaborate more on text just to remind myself

add env to the output

https://docs.microsoft.com/en-us/dotnet/api/system.datetime.tostring?redirectedfrom=MSDN&view=netframework-4.7.2#System_DateTime_ToString_System_String_

ToString('u') generates 'Z' timezone output despite that data is in fact in localtime

• afl .. list functions
• s .. seek to function name
• VVV .. start visual mode
• ARROWS .. move the graph
• note the [gX] all around, can be used to navigate through call graph
• c .. swith cursor mode, can move whole graph, can move selected node around
• r .. refresh the graph, but also somehow toggles function jump shortcuts ;[gX]

https://r2wiki.readthedocs.io/en/latest/options/capv/visual-mode/vv-help/

https://blogs.technet.microsoft.com/secadv/2018/01/22/parsing-dns-server-log-to-track-active-clients/
https://gist.github.com/randomvariable/be90107fd57a4f9502af2eba62978fb6

function Start-DNSClientLog {
    $DnsOpLog = Get-WinEvent -ListLog Microsoft-Windows-DNS-Client/Operational
    $DnsOpLog.IsEnabled = $true
    $DnsOpLog.SaveChanges()
}


function Get-DNSClientQueries {
    foreach($event in (get-winevent Microsoft-Windows-DNS-Client/Operational | % { [xml]$_.ToXml() })) {
        $Query = ($event.Event.EventData.Data | Where-Object { $_.Name -eq "QueryName" }).'#text'
        if($null -eq $Query) { return }
        New-Object PSObject -Property @{
            "Date" = [DateTime]$event.Event.System.TimeCreated.SystemTime;
            "Query" = $Query
        }   
    }
}

to switch from live log to offline file

$events = Get-WinEvent -FilterHashtable @{Path="system.evtx";ID=7030,7045} -Oldest