Queries the registry for the known network profiles and their last and first connection time. Useful for DFIR if you want to check when a host was last connected to a certain network.

Get-LastKnownNetworks.ps1

function Get-LastKnownNetworks
{

function ConvertFrom-SystemTimeStructure
{
    [CmdletBinding()]
    Param (
        [Parameter(ValueFromPipeline=$true)]
        [ValidateNotNullOrEmpty()]
        [String]
        $TimeString)

    $ConvertedTime = @()
    
    for ($i = 0; $i -lt $TimeString.Length; $i=$i+4) {
        
        $PartString = $TimeString.Substring($i,4)
        $Reordered = $PartString.Substring(2,2) + $PartString.Substring(0,2)
        $Reordered = ([uint32]("0x" + $Reordered)).ToString()
        $ConvertedTime += $Reordered
    }

    #128 bit system time structure - explained here -> https://www.giac.org/paper/gawn/1623/wireless-networks-windows-registry-computer-been/121403
    $Result = $ConvertedTime[0] + "-" + $ConvertedTime[1] + "-" + $ConvertedTime[3] + " " + $ConvertedTime[4] + ":" + $ConvertedTime[5] + ":" + $ConvertedTime[6] + "." + $ConvertedTime[7]
    $Result
}

$ProfileKey = "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles"

$ProfilesFromRegistry = ls $ProfileKey
$NetworkProfiles = @()

foreach($p in $ProfilesFromRegistry)
{
    $pso = [PSCustomObject]@{
        Name = Get-ItemPropertyValue -Path $p.pspath -Name ProfileName
        DateLastConnected = ""
        DateCreated = ""
    }

    $DateLastConnectedRaw = ([System.Bitconverter]::ToString((Get-ItemPropertyValue -Path $p.pspath -Name DateLastConnected))).replace("-","")
    $DateCreatedRaw = ([System.Bitconverter]::ToString((Get-ItemPropertyValue -Path $p.pspath -Name DateCreated))).replace("-","")

    if ($DateLastConnectedRaw -ne "")
    {
        $pso.DateLastConnected = ConvertFrom-SystemTimeStructure -TimeString $DateLastConnectedRaw
        #$pso.DateLastConnected = $DateLastConnectedRaw
    }
    if($DateCreatedRaw -ne "")
    {
        $pso.DateCreated = ConvertFrom-SystemTimeStructure -TimeString $DateCreatedRaw
        #$pso.DateCreated = $DateCreatedRaw
    }
    
    $NetworkProfiles += $pso
}

$NetworkProfiles

}