cfalta

function Export-UserToCsV
{
    Get-ADUser -filter * -Properties *| select samaccountname,description | export-csv .\userlist.csv -NoTypeInformation
}

function Get-Password([int]$Length)
{
    if($Length -gt 0)
    {
        $Alphabet = @("0","1","2","3","4","5","6","7","8","9",":",";","<","=",">","?","!","A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z","_","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z")

cfalta

$ASRGuidMatrix = @{'56a863a9-875e-4185-98a7-b882c64b5ce5' ='Block abuse of exploited vulnerable signed drivers';
'7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c' = 'Block Adobe Reader from creating child processes';
'd4f940ab-401b-4efc-aadc-ad5f3c50688a' = 'Block all Office applications from creating child processes';
'9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2' = 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)';
'be9ba2d9-53ea-4cdc-84e5-9b1eeee46550' = 'Block executable content from email client and webmail';
'01443614-cd74-433a-b99e-2ecdc07bfc25' = 'Block executable files from running unless they meet a prevalence, age, or trusted list criterion';
'5beb7efe-fd9a-4556-801d-275e5ffc04cc'='Block execution of potentially obfuscated scripts';
'd3e037e1-3eb8-44c8-a917-57927947596d'='Block JavaScript or VBScript from launching downloaded executable content';
'3b576869-a4ec-4529-8536-b80a7769e899'='Block Office applications from creating executable content';
'75668c1f-73b5-4cf0-bb93-3ecf5

cfalta

function Get-LastKnownNetworks
{

function ConvertFrom-SystemTimeStructure
{
    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$true)]
        [ValidateNotNullOrEmpty()]
        [String]

cfalta

#Requires –Modules ActiveDirectory
#Requires –Modules dsinternals

param([string]$Computername)

#Binary grep function, stolen from stackoverflow https://stackoverflow.com/questions/62400436/powershell-binary-grep
Function Find-Bytes([byte[]]$Bytes, [byte[]]$Search, [int]$Start, [Switch]$All) {
    For ($Index = $Start; $Index -le $Bytes.Length - $Search.Length ; $Index++) {
        For ($i = 0; $i -lt $Search.Length -and $Bytes[$Index + $i] -eq $Search[$i]; $i++) {}
        If ($i -ge $Search.Length) { 

cfalta

Windows Updates with phased rollout

A list of updates addressed in a phased rollout (aka. enforcements) on Windows/ActiveDirectory that I am aware of. Microsoft usually chooses this approach if they know, that the final implementation of the update will likely break stuff. That's why there's always one or more inital phases that introduce new events or audit capabilities to let you check for potential impact before the final enforcement phase.

The first table is a list of update phases which are currently running. The second table is a list of once planned but then postponed enforcements (so they will reappear in the future I guess).

Active enforcements

Name	CVE	Initial Phases	Enforcement Phase	Event Log	EventCodes	Link
LDAP Permission changes	CVE-2021-42291	Phase 1: 9.11.2021	09.01.2024	Directory Services	3050,3051,3052,30533054,3055,3047,30483049,3056,3044,30453046	https://support.microsoft.com/en-us/topic/kb5008383-active-directory-p

cfalta

<#
.SYNOPSIS

This is a simple script meant to help on your way towards better kerberos encryption (looking at you RC4!) with regards to kerberoasting.

It shows the required encryption types for all kerberoastable user accounts (== user object with spn). Every account that supports somehting else than AES will be marked as unsafe so you can filter for that.

Author: Christoph Falta (@cfalta)

.PARAMETER UnsafeOnly

cfalta

rpc
filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e
add filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d
add filter
add rule layer=um actiontype=block
add condition field=if_uuid matchtype=equal data=12345678-1234-ABCD-EF00-0123456789AB

cfalta

function Test-Greynoise
{
    [CmdletBinding()]
Param (
    [Parameter(Mandatory = $false, ValueFromPipeline = $true)]
    [ValidatePattern({\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}})]
    [String]
    $IP)

    if(-not $IP)

cfalta

Write-Output "not inside function block"

function Invoke-Hello
{
  Write-Output "hello from inside the function block"
}

cfalta

function Disable-AMSI
{
    Set-PSReadlineOption -HistorySaveStyle SaveNothing

$AMSIBypass2=@"
using System;
using System.Runtime.InteropServices;

namespace RandomNamespace
{