Skip to content

Instantly share code, notes, and snippets.

@mgeeky

mgeeky/cobaltstrike-argue-powershell.txt

Created April 26, 2019 12:40
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mgeeky/96ce16c710480cb93ec98df4e2e95f3b to your computer and use it in GitHub Desktop.
Save mgeeky/96ce16c710480cb93ec98df4e2e95f3b to your computer and use it in GitHub Desktop.
Download ZIP
CobaltStrike's argue command with parameters for "powershell" command.
Raw
cobaltstrike-argue-powershell.txt
argue powershell Get-WmiObject -Class ccm_application -Namespace root\ccm\clientsdk -ComputerName (get-content C:\Windows\System32\drivers\etc\hosts) | Where-Object { ($_.InstallState -ne "Installed") -and ($_.ApplicabilityState -eq "Applicable") -and ($_.IsMachineTarget -eq $True) -and ($_.EvaluationState -ne 1)} | select FullName,__SERVER ; Get-WMIobject win32_networkadapterconfiguration | where {$_.IPEnabled -eq “True”} | Select-Object pscomputername,ipaddress,defaultipgateway,ipsubnet,dnsserversearchorder,winsprimaryserver | format-Table -Auto ; Get-EventLog -log system -newest 1000 | where-object {$_.eventid -eq '1074'} | format-table machinename, username, timegenerated -autosize
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment