bodik / defender Goto Github PK

https://isc.sans.edu/diary.html?n&storyid=23840

to switch from live log to offline file

$events = Get-WinEvent -FilterHashtable @{Path="system.evtx";ID=7030,7045} -Oldest

https://blogs.technet.microsoft.com/secadv/2018/01/22/parsing-dns-server-log-to-track-active-clients/
https://gist.github.com/randomvariable/be90107fd57a4f9502af2eba62978fb6

function Start-DNSClientLog {
    $DnsOpLog = Get-WinEvent -ListLog Microsoft-Windows-DNS-Client/Operational
    $DnsOpLog.IsEnabled = $true
    $DnsOpLog.SaveChanges()
}


function Get-DNSClientQueries {
    foreach($event in (get-winevent Microsoft-Windows-DNS-Client/Operational | % { [xml]$_.ToXml() })) {
        $Query = ($event.Event.EventData.Data | Where-Object { $_.Name -eq "QueryName" }).'#text'
        if($null -eq $Query) { return }
        New-Object PSObject -Property @{
            "Date" = [DateTime]$event.Event.System.TimeCreated.SystemTime;
            "Query" = $Query
        }   
    }
}

Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem, OperatingSystemServicePack | Format-List name, ipv4*, oper*

https://docs.microsoft.com/en-us/dotnet/api/system.datetime.tostring?redirectedfrom=MSDN&view=netframework-4.7.2#System_DateTime_ToString_System_String_

ToString('u') generates 'Z' timezone output despite that data is in fact in localtime

add env to the output

• afl .. list functions
• s .. seek to function name
• VVV .. start visual mode
• ARROWS .. move the graph
• note the [gX] all around, can be used to navigate through call graph
• c .. swith cursor mode, can move whole graph, can move selected node around
• r .. refresh the graph, but also somehow toggles function jump shortcuts ;[gX]

https://r2wiki.readthedocs.io/en/latest/options/capv/visual-mode/vv-help/

https://pentestlab.blog/2018/05/10/applocker-bypass-cmstp/

C in MAC times does not stand for creation (as it corelates many times) but for 'change of attributes'

elaborate more on text just to remind myself