Skip to content

Instantly share code, notes, and snippets.

View ms_posh_exploit_detect
$ProgressPreference = 'SilentlyContinue';$Session=New-Object -ComObject 'Microsoft.Update.Session';$Searcher=$Session.CreateUpdateSearcher();$FormatEnumerationLimit=-1;$historyCount=$Searcher.GetTotalHistoryCount(); if ($historyCount -gt 0) {$xx=$($Searcher.QueryHistory(0, $historyCount)|Select-Object Title, Date, Operation, Resultcode|Where-Object {$_.Operation -like 1 -and $_.Resultcode -match '[123]'}| Select-object Title); } else {$xx=$(Get-Hotfix|Where-object {$_.hotfixid -match 'KB\d{6,7}'}| Select-object Hotfixid)}; If ($xx -eq $null) {'WARNING - No updates returned'} else {$xx = $xx|Where-Object {$_ -match 'KB(401221[2-8]|4012598|4012606|4013198|4013429|4015217|4015438|401554[69]|401555[02]|4016635|4019215|401926[34]|4019472)' -or ( $_ -match '^((2017-0[3-9]|2017-1[0-2]|2018-[0-9-){7}|(Ma|A|Ju|[SOND][^ ]+ber).* 2017 |[a-z]{3,10} 201[89] )' -and $_ -match '(Security .*Rollup|Cumulative Update) for Windows')}; If ($xx -eq $null) {'Vulnerable'} else {'Secured - Detected Updates: ' + ($xx | Select-String