Elektrine
Log in Register

#powershell

25 posts · Last used 13d

Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 1w ago
Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence. #TaskStomp #PowerShell #Malware #CyberSecurity #ThreatIntel https://securityonline.info/taskstomp-powershell-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
New TASK#STOMP PowerShell Backdoor Targets Windows
Daily CyberSecurity

New TASK#STOMP PowerShell Backdoor Targets Windows

Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence.

1
0
1
0
PSConfEU @psconf.eu@bsky.brid.gy
· 2mo ago

💡 Think you're getting the most out of #VSCode for #PowerShell?

@posh.guru@bsky.brid.gy showcases the latest improvements, from rename support and terminal IntelliSense to Spectre, Zed integration, and remote debugging with VS Code tunnels.

▶️ youtu.be/Lso0H9mcrkg?si=2W7...

#PSConfEU

  • YouTube
0
0
0
0
PSConfEU @psconf.eu@bsky.brid.gy
· 2mo ago

🤔 Why does #PowerShell behave the way it does?

@brucepayette.bsky.social@bsky.brid.gy, one of PowerShell's original architects, explains the design decisions behind pipelines, remoting, parameter binding, error handling, and more.

A fascinating look behind the curtain 👉 youtu.be/UhuBPRv5K0A?si=swn...

  • YouTube
0
0
0
0
PSConfEU @psconf.eu@bsky.brid.gy
· 2mo ago
☀️ End of the week. End of the month. Still summer. Need something refreshing? 🧊 All #PoShaKucha sessions from #PSConfEU are now available on YouTube! Short talks. Big ideas. Perfect for a sunny break. 😎 ▶️ Watch now and pick your favourite!  👉 youtube.com/playlist?list=P... #PowerShell
0
0
0
0
Daniel Owen @daniel@infosec.exchange
· 2mo ago
I like a fresh lab. I do not like building one for the umpteenth time, especially when the build takes longer than the thing I actually wanted to test. build-lab is the final piece in a three-script set, and the one that ties the other two together. One command, an ISO, and roughly half an hour later you have a Windows Server 2025 domain controller. Log on once and the domain populates itself with a directory that looks lived in, nested groups and GPOs and an Enterprise CA included. No GUI, no answer file to hand-edit, no clicking Next. This is an orchestrator. It calls New-VMwareWorkstationVM to build and start the VM, pushes the new-AdDomain payload into the guest over vmrun, and kicks off the promotion. Still PowerShell 5.1, still nothing outside what Microsoft and VMware already ship. One thing is deliberately manual. Directory population runs from a scheduled task that fires at your first Administrator logon, so you do have to log into the console once. I could automate it by storing a domain Administrator password under a startup-triggered task. That's the one compromise I decided not to make, even in a lab, and I'm still not certain it was the right call. The interesting problem was verification. A successful AD promotion reboots Windows immediately, which tears down the vmrun guest-operations channel mid-call. A blocking call hung on that reboot and never came back. So the guest script gets launched fire-and-forget, which means there is no exit code to read. Just silence. Instead, build-lab confirms success by polling for ntds.dit in the guest, and pulls the guest's deployment logs back to the host either way, because the run you need logs from is the one that failed. https://github.com/0x44616e69656c/build-lab What's the step in your lab build that you've rebuilt by hand so many times you've stopped noticing it? #PowerShell #ActiveDirectory #WindowsServer #Automation #HomeLab #VMware #InfoSec
GitHub

GitHub - 0x44616e69656c/build-lab: Stands up a lab Active Directory domain controller from an ISO in one command: builds the Windows Server 2025 VM, promotes the forest, and stages a lived-in AD domain that populates itself at your first Administrator log

Stands up a lab Active Directory domain controller from an ISO in one command: builds the Windows Server 2025 VM, promotes the forest, and stages a lived-in AD domain that populates itself at your ...

5
3
2
0
Daniel Owen @daniel@infosec.exchange
· 2mo ago
I really dislike sitting down to a lab environment that looks bare. Three users. A couple of empty OUs. Domain Admins with one lonely account. Nothing that feels real. It often doesn't matter, but it bugs me. I'm not going to hand craft hundreds or thousands of objects for a lab, but automation doesn't care. New-AdDomain takes a clean Windows Server 2025 machine and builds a realistic Active Directory forest. Proper OU structure, nested groups, computer and service accounts, GPOs, sites, an Enterprise Root CA, and enough lived-in state that security tools and attack simulations have something meaningful to work with. Pure PowerShell. No Ansible. No third-party dependencies. https://github.com/0x44616e69656c/new-AdDomain #PowerShell #ActiveDirectory #WindowsServer #HomeLab
GitHub

GitHub - 0x44616e69656c/new-AdDomain: Stands up a fresh Windows Server 2025 Active Directory forest and fills it with realistic-looking users, groups, computers, service accounts, GPOs, and a certificate authority. Built for labs, demos, red-team ranges,

Stands up a fresh Windows Server 2025 Active Directory forest and fills it with realistic-looking users, groups, computers, service accounts, GPOs, and a certificate authority. Built for labs, demo...

1
2
0
0
Daniel Owen @daniel@infosec.exchange
· 2mo ago
Got tired of clicking through Windows Server Setup for every disposable lab VM, so I automated it. New-VMwareWorkstationVM takes a Windows Server 2025 ISO and gives you back a running, network-reachable VM. It generates an autounattend.xml, builds a bootable ISO with IMAPI2, creates a sparse VMDK, writes the VMX, and drops everything into your Workstation library. MIT licensed. Requires VMware Workstation 17+ and a Windows Server 2025 ISO. Nothing else. https://github.com/0x44616e69656c/New-VMwareWorkstationVM #PowerShell #VMware #HomeLab
GitHub

GitHub - 0x44616e69656c/New-VMwareWorkstationVM: Unattended Windows Server 2025 deployment to VMware Workstation. One command. No ADK. No clicking through Setup. If you have ever sat there pressing Next through Windows Server Setup on a VM you know you a

Unattended Windows Server 2025 deployment to VMware Workstation. One command. No ADK. No clicking through Setup. If you have ever sat there pressing Next through Windows Server Setup on a VM you k...

2
1
0
0