Forensics and Security

Active Directory Exploitation [EVERYTHING]

Summary Active Directory Exploitation Cheatsheet Summary Tools Domain Enumeration Using PowerView Using AD Module Using BloodHound Useful Enumeration Tools Local Privilege Escalation Lateral Movement Powershell Remoting Remote Code Execution with PS Credentials Import a powershell module and execute its functions remotely Executing Remote Stateful commands Mimikatz Useful Tools Domain Privilege …

Read More »

Powershell is POWERED SHELL for Sysadmins and Penetration testers

This article contains a list of PowerShell commands collected from various corners of the Internet which could be helpful during penetration tests or red team exercises. The list includes various post-exploitation one-liners in pure PowerShell without requiring any offensive (= potentially flagged as malicious) 3rd party modules, but also a …

Read More »

Digital Forensics and Incident Response

IntroductionDisclaimerArtifact locationsGet an object of forensic artifactsQuery object for relevant registry keys:Query object for relevant file paths:Windows Cheat SheetOrder of VolatilityMemory Files (Locked by OS during use)Binalyze IREC Evidence Collector (GUI or CommandLine)Belkasoft Live RAM CapturerRedlineMemoryzeComae DumpITMagnet Forensics (Mostly GUI)Volexity SurgeMicrosoft LiveKdWinpmemImaging Live MachinesFTK Imager (Cmd version, mostly GUI for …

Read More »