sassdawe

$module = "module name"
$folder = "destination folder"

(((Get-Module $module).ExportedFunctions).Values.GetEnumerator()) | Foreach-Object { 
  "function $($_.Name) { `n $($_.definition)`n}" > "$folder\function-$($_.name).ps1"
}

sassdawe

#requires -version 7
#You can load this script with $(iwr https://tinyurl.com/TraceAICommand | iex)
using namespace Microsoft.ApplicationInsights
using namespace Microsoft.ApplicationInsights.Extensibility
using namespace Microsoft.ApplicationInsights.DataContracts
using namespace System.Management.Automation
using namespace System.Collections.Generic
using namespace System.Net

#Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/app/console

sassdawe

# Taken from : https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py
function Start-WebcamRecorder
{
  <#
  .SYNOPSIS
  This function utilizes the DirectX and DShowNET assemblies to record video from the host's webcam.
  Author: Chris Ross (@xorrior)
  License: BSD 3-Clause
  .DESCRIPTION
  This function will capture video output from the hosts webcamera. Note that if compression is available, there isn't 

sassdawe

function Protect-FromMyself {
    <#
    .SYNOPSIS
        Protect-FromMyself
    .DESCRIPTION
        Protect-FromMyself will turn on `-WhatIf` for all comdlets that support it. To help protect against accidental changes.
    .NOTES
    .LINK
    #>
    [CmdletBinding()]

sassdawe

<#
.Synopsis
    Get-LatestLTS
.DESCRIPTION
    Long description
.EXAMPLE
    Example of how to use this cmdlet
.EXAMPLE
    Another example of how to use this cmdlet

sassdawe

using System;
using System.IO;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.InteropServices;

namespace ByteArrayExec
{

sassdawe

<#
.Synopsis
   New-AzureADTestUser
.DESCRIPTION
   New-AzureADTestUser will create one or more random Azure AD test account(s).
   The randomness is achieved using https://randomuser.me/api/.
   The account(s) will be disabled, and the password(s) will be a random Guid.
.EXAMPLE

sassdawe

function clear-url {
    [cmdletbinding()]
    [alias('cc')]
    param(
        [string]$url = @(Get-Clipboard)[0]
    )
    $url = $url.Trim()
    Write-Verbose "original url: `'$url`'"
    if ( ([uri]$url).Query ) {
        Write-Verbose "removing: `'$(([uri]$url).Query)`'"

sassdawe

Function Debug-PowerShell() {
    [CmdletBinding()]
    [Alias("dbps")]
    param (
        [string]$Path = "$ENV:TEMP\psdebu.log"
    )
    $Global:DebugLog = $Path
    New-Item $Global:DebugLog -Force -ItemType File
    Start-Process powershell -ArgumentList "-noprofile","-command &{Get-Content '$DebugLog' -Wait}"
}

sassdawe

$WMI = @{
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'MSFT_MpPreference' AND TargetInstance.DisableRealtimeMonitoring=True"
    Action = {
	      #$Global:Data = $Event
        Write-Host "Defender Configuration change - DisableRealtimeMonitoring:"$Event.SourceEventArgs.NewEvent.TargetInstance.DisableRealtimeMonitoring"(Old Value:"$Event.SourceEventArgs.NewEvent.PreviousInstance.DisableRealtimeMonitoring")"
    }
	Namespace = 'root\microsoft\windows\defender'
    SourceIdentifier = "Defender.DisableRealtimeMonitoring"
}
$Null = Register-WMIEvent @WMI