Skip to content

Instantly share code, notes, and snippets.

View scriptingstudio's full-sized avatar
👍
Awake and ready

Matthew Gray scriptingstudio

👍
Awake and ready
  • Interstellar Systems
  • Hiranyaloka
View GitHub Profile
<?xml version="1.0" encoding="utf-8"?>
<!-- Sample Autounattend.xml for Windows 10 media. This has been tested on 1511, 1607, and 1709 - x64 architecture only
For more details visit my blog http://blogs.catapultsystems.com/mdowst/archive/2017/12/11/create-zero-touch-windows-10-iso/ -->
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="windowsPE">
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
<DiskConfiguration>
<Disk wcm:action="add">
<DiskID>0</DiskID>
<WillWipeDisk>true</WillWipeDisk>
@mattifestation
mattifestation / LoadInMemoryModule.ps1
Created March 30, 2018 18:01
A stealthier method of loading a .NET PE in memory - via the Assembly.LoadModule method
$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object System.Reflection.AssemblyName('TempAssembly')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('TempModule')
# Create a stub module that the in-memory module (i.e. this mimics the loading of a netmodule at runtime) will be loaded into.
$ModuleBuilder2 = $AssemblyBuilder.DefineDynamicModule('hello.dll')
$TypeBuilder = $ModuleBuilder.DefineType('TempClass', [Reflection.TypeAttributes]::Public)
$TypeBuilder.CreateType()
$HelloDllBytes = [Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAJNPvloAAAAAAAAAAOAAAiELAQsAAAQAAAAGAAAAAAAAPiMAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAOQiAABXAAAAAEAAAJgCAAAAAAAAAAAAAAAAAAA
@potatoqualitee
potatoqualitee / Invoke-WsusDbQuery.ps1
Created August 1, 2019 09:13
Create a connection to a WSUS database using PowerShell
# No longer used but didn't want to throw it away.
function Invoke-WsusDbQuery {
[CmdletBinding()]
param (
[string]$ComputerName = $script:WsusServer,
[PSCredential]$Credential = $script:WsusServerCredential,
[string]$Pattern,
[string]$UpdateId,
[switch]$EnableException
)
@jdhitsolutions
jdhitsolutions / PSFunctionInfo.format.ps1xml
Last active March 8, 2023 12:52
A proof of concept to add and get PowerShell meta data information
<?xml version="1.0" encoding="UTF-8"?>
<!--
format type data generated 01/27/2020 10:30:02 by BOVINE320\Jeff
-->
<Configuration>
<ViewDefinitions>
<View>
<!--Created 01/27/2020 10:30:02 by BOVINE320\Jeff-->
<Name>default</Name>
<ViewSelectedBy>
function get-redirectedUrls
{
Param($url)
$urlcheckobject=@{}
$Uri = [uri]$url
$url2check = $url
do{
$value = get-redirectedUrl -url $url2check
if($value.redirect)
{
function Get-XmlFileTreeAppend
{
param(
[Parameter(ParameterSetName='Path', Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
[string[]]
${Path},
[Parameter(ParameterSetName='LiteralPath', Mandatory=$true, ValueFromPipelineByPropertyName=$true)]
[Alias('PSPath')]
[string[]]
@jhoneill
jhoneill / Chrome Databases.ipynb
Last active June 6, 2025 07:50
Exploring data saved by Chrome/Edge/Any Chromium (passwords done in another Gist)
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
@rjmholt
rjmholt / powershellAPI.md
Last active June 9, 2026 12:11
Using the PowerShell API

Using the PowerShell .NET API

There are a number cases where it's desirable to call PowerShell from another .NET language, particularly from C#. The two main classes of scenario here are:

  • Running PowerShell code or reusing PowerShell commands from a cmdlet or module.
  • Using PowerShell from a standalone .NET application, usually by hosting a fresh instance of PowerShell

Both use cases have a largely similar usage pattern,

@jdhitsolutions
jdhitsolutions / Get-ADUserAudit.ps1
Last active February 18, 2024 05:18
A PowerShell function and format file for getting Active Directory user management events from the security event logs on domain controllers.
#requires -version 5.1
#requires -module ActiveDirectory
#you might need to increase the size of the Security eventlog
# limit-eventlog -LogName security -ComputerName dom2,dom1 -MaximumSize 1024MB
Function Get-ADUserAudit {
[cmdletbinding()]
Param(
[Parameter(Position=0,HelpMessage = "Specify one or more domain controllers to query.")]
@githubfoam
githubfoam / windows event logs cheat sheet
Last active August 26, 2026 05:19
windows event logs cheat sheet
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
# PS : ChatGPT makes mistakes, consider "trust but verify" principle
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#Events to Monitor
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#run
eventvwr.msc Event viewer
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Event Viewer(Local)-Windows Logs (shutdown / restart )