Purp1eW0lf

gwmi win32_useraccount | 
select Name, SID | 
? SID -match "" #insert SID between quotes 

Purp1eW0lf

# Download and use script
 wget -usebasicparsing https://raw.githubusercontent.com/mgreen27/Invoke-LiveResponse/master/Content/Other/Get-BAMParser.ps1 -outfile Get-BAMParser.ps1;
./Get-BAMParser.ps1 | out-string

# run and look at BAM manually
reg query "HKLM\SYSTEM\CurrentControlSet\Services\bam\state\UserSettings" /s

Purp1eW0lf

# stupid overengineered solution
$ErrorActionPreference= 'silentlycontinue'; 
$value = gp "REGISTRY::HKEY_USERS\*\Software\Sysinternals\PsExec";
$SID = $value.PsPath -split '\',4,'SimpleMatch' | select-string -pattern "S-" | % { $_.Line }
$NAME = gwmi win32_useraccount | ? SID -match $SID | select -expandproperty Name;
if ($value.EulaAccepted -eq 0){} else { write-host -NoNewline "`n Registry confirms PsExec used by "; write-host "$Name`n" -ForegroundColor magenta}

Purp1eW0lf

<#
Meta
    Date: 2022 March 28th
    Updated: 2023 October 6th
    Authors: Dray Agha (Twitter @purp1ew0lf), Dipo Rodipe (Twitter @dipotwb)
    Company: Huntress Labs
    Purpose: Automate setting up Sysmon and pulling Ippsec's sysmon IoC streamliner. Great for malware lab. 
#>

################################################################################################################

Purp1eW0lf

#Ensure errors don't ruin anything for us
$ErrorActionPreference = "SilentlyContinue"


# Set variables
$DesktopPath = [Environment]::GetFolderPath("Desktop")

$basic = "C:\windows\System32\winevt\Logs\Application.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx", "C:\windows\System32\winevt\Logs\System.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx", "C:\windows\System32\winevt\Logs\Security.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx"

$remote_logs = "C:\windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx"

Purp1eW0lf

#show the users' session
qwinsta

#target their session id
logoff 3 /v

Purp1eW0lf

get-winevent -logname "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | 
? id -match 1149 | 
sort Time* -descending | 
fl time*, message

Purp1eW0lf

remove-adgroupmember -identity Administrators -members "erochester" -verbose -confirm:$false

Purp1eW0lf

$user = "erochester" ; 
$newPass = "[New-Password-Please]"; 

#Change password twice. 
#First can be junk password, second time can be real new password
Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "6;wB3yj9cI8X" -Force) -verbose

Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$newPass" -Force) -verbose

#If the machine is not connected to AD, or account is a local one use this instead

Purp1eW0lf

dir C:\Windows\Prefetch | sort LastWriteTime -desc