Purp1eW0lf

gwmi win32_process | 
Select Name,@{n='Owner';e={$_.GetOwner().User}},CommandLine |
sort Name -unique -descending | Sort Owner | 
ft -wrap -autosize

Purp1eW0lf

get-wsmaninstance -resourceuri shell -enumerate | 
select Name, State, Owner, ClientIP, ProcessID, MemoryUsed, 
@{Name = "ShellRunTime"; Expression = {[System.Xml.XmlConvert]::ToTimeSpan($_.ShellRunTime)}}, 
@{Name = "ShellInactivity"; Expression = {[System.Xml.XmlConvert]::ToTimeSpan($_.ShellInactivity)}}

Purp1eW0lf

#needs the SAMAccountName
$user = "afairfax"; 
Disable-ADAccount -Identity "$user" -whatif # confirm this is what you want
Disable-ADAccount -Identity "$user" -verbose

#check it's disabled. Will return false if it is disabled. 
(Get-ADUser -Identity $user).enabled

#re-enable the account when you're ready
$user = "afairfax"; 

Purp1eW0lf

dir C:\Windows\Prefetch | sort LastWriteTime -desc

Purp1eW0lf

$user = "erochester" ; 
$newPass = "[New-Password-Please]"; 

#Change password twice. 
#First can be junk password, second time can be real new password
Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "6;wB3yj9cI8X" -Force) -verbose

Set-ADAccountPassword -Identity $user -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$newPass" -Force) -verbose

#If the machine is not connected to AD, or account is a local one use this instead

Purp1eW0lf

remove-adgroupmember -identity Administrators -members "erochester" -verbose -confirm:$false

Purp1eW0lf

get-winevent -logname "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" | 
? id -match 1149 | 
sort Time* -descending | 
fl time*, message

Purp1eW0lf

#show the users' session
qwinsta

#target their session id
logoff 3 /v

Purp1eW0lf

#Ensure errors don't ruin anything for us
$ErrorActionPreference = "SilentlyContinue"


# Set variables
$DesktopPath = [Environment]::GetFolderPath("Desktop")

$basic = "C:\windows\System32\winevt\Logs\Application.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx", "C:\windows\System32\winevt\Logs\System.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx", "C:\windows\System32\winevt\Logs\Security.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx"

$remote_logs = "C:\windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", "C:\windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx"

Purp1eW0lf

<#
Meta
    Date: 2022 March 28th
    Updated: 2023 October 6th
    Authors: Dray Agha (Twitter @purp1ew0lf), Dipo Rodipe (Twitter @dipotwb)
    Company: Huntress Labs
    Purpose: Automate setting up Sysmon and pulling Ippsec's sysmon IoC streamliner. Great for malware lab. 
#>

################################################################################################################