raandree

$t1 = [datetime]::Today.AddHours(4).ToString('s')
$e = $null
$FilterXML = @"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
(*[EventData[
Data[@Name="TargetDomainName"] != "Window Manager" and
Data[@Name="TargetDomainName"] != "Font Driver Host" and
Data[@Name="TargetDomainName"] != "NT AUTHORITY"

raandree

$code = @'
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;

namespace Test

raandree

$sessions = klist sessions
$pattern = '\[(\d+)\] Session \d \d:(?<LowPart>0)x(?<HighPart>[a-f0-9]+)'

$sessions = foreach ($line in $sessions)
{
    if ($line -match $pattern)
    {
        New-Object PSObject -Property @{
            LowPart = $Matches.LowPart
            HighPart = $Matches.HighPart

raandree

function GenerateRandomSalt
{
    [byte[]]$data = New-Object byte[](32)

    $cp = [System.Security.Cryptography.RNGCryptoServiceProvider]::new()
    
    for ($i = 0; $i -lt 10; $i++)
    {            
        $cp.GetBytes($data)
    }

raandree

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
mkdir -Path C:\ProgramData\Microsoft\Windows\PowerShell\PowerShellGet -Force
Invoke-WebRequest -Uri 'https://nuget.org/nuget.exe' -OutFile C:\ProgramData\Microsoft\Windows\PowerShell\PowerShellGet\nuget.exe -ErrorAction Stop

Install-PackageProvider -Name NuGet -Force

Install-Module -Name PowerShellGet -Force

raandree

<#
    .SYNOPSIS
    Powerful asynchronus IPv4 Port Scanner

    .DESCRIPTION
    This powerful asynchronus IPv4 Port Scanner allows you to scan every Port-Range you want (500 to 2600 would work).

    The result will contain the Port number, Protocol, Service name, Description and the Status.

    .EXAMPLE

raandree

param (
    [Parameter(Mandatory)]
    $ResourceGroupName,

    [Parameter(Mandatory)]
    $VmName,

    [Parameter(Mandatory)]
    [ValidateSet('Standard_LRS', 'Premium_LRS', 'StandardSSD_LRS', 'UltraSSD_LRS')]
    $StorageType,

raandree

$vms = Get-LabVM -Role FileServer

$wiresharkUri = 'https://1.eu.dl.wireshark.org/win64/Wireshark-win64-3.2.2.exe'
$fiddlerUri = 'https://telerik-fiddler.s3.amazonaws.com/fiddler/FiddlerSetup.exe'

$fiddler = Get-LabInternetFile -Uri $fiddlerUri -Path $labSources\SoftwarePackages -PassThru
$wireshark = Get-LabInternetFile -Uri $wiresharkUri -Path $labSources\SoftwarePackages -FileName Wireshark.exe -PassThru

Install-LabSoftwarePackage -Path $fiddler.FullName -CommandLine /S -ComputerName $vms
Install-LabSoftwarePackage -Path $wireshark.FullName -CommandLine /S -ComputerName $vms

raandree

SELECT
    s.session_id,
    c.connect_time,
    s.login_time,
    s.login_name,
    c.protocol_type,
    c.auth_scheme,
    s.HOST_NAME,
    s.program_name
FROM sys.dm_exec_sessions s

raandree

[DSCLocalConfigurationManager()]
configuration LcmDebugConfig
{
    Node localhost
    {
        Settings
        {
            RefreshMode = 'Push'
            DebugMode = 'ForceModuleImport'
        }