Skip to content

Instantly share code, notes, and snippets.

View santisq's full-sized avatar

Santiago Squarzon santisq

View GitHub Profile
@figueroadavid
figueroadavid / Test-EventSourceByLog.ps1
Created January 10, 2024 17:38
Test multiple logs for different event sources that may or may not be in the registry keys
View Test-EventSourceByLog.ps1
function Test-EventSourceByLog {
<#
.SYNOPSIS
This tests for multiple sources in multiple eventlogs
.DESCRIPTION
This works regardless of if it exists directly in registry or not.
This is different than the Test-EventSource which uses a dotnet function
to check for all the sources that are directly listed in the registry.
@jborean93
jborean93 / AsyncPSCmdlet.cs
Last active January 30, 2024 20:52
Async PSCmdlet base class
View AsyncPSCmdlet.cs
using System;
using System.Collections.Concurrent;
using System.Management.Automation;
using System.Threading;
using System.Threading.Tasks;
public abstract class AsyncPSCmdlet : PSCmdlet, IDisposable
{
private enum PipelineType
{
@JustinGrote
JustinGrote / TestICMP.csproj
Last active February 14, 2023 18:10
Async Pinger Powershell Cmdlet in C#
View TestICMP.csproj
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net7.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="System.Management.Automation" Version="7.3.2" PrivateAssets="all" />
View ghcommands.format.ps1xml
<Configuration>
<ViewDefinitions>
<View>
<Name>Utility.PullRequest</Name>
<ViewSelectedBy>
<TypeName>Utility.PullRequest</TypeName>
</ViewSelectedBy>
<CustomControl>
<CustomEntries>
<CustomEntry>
@jborean93
jborean93 / Get-WTSSessionInfo.ps1
Last active August 23, 2022 03:52
Tries to replicate qwinsta but return structured objects
View Get-WTSSessionInfo.ps1
# Copyright: (c) 2022, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function Get-WTSSessionInfo {
<#
.SYNOPSIS
Enumerates sessions on a Windows host.
.DESCRIPTION
Enumerates all the sessions available on a Windows host through the WTSEnumerateSessionsExW API.
View oh-god-why.ps1
using namespace System
using namespace System.Linq
using namespace System.Collections
using namespace System.Collections.Generic
using namespace System.Management.Automation
using namespace System.Management.Automation.Language
using namespace System.Reflection
# Hey person reading this! Don't do this, alright? You'll have a bad time. ty
@jborean93
jborean93 / Start-ProcessEx.ps1
Last active October 23, 2023 19:53
PowerShell wrapper around CreateProcess that exposes more low level items
View Start-ProcessEx.ps1
# Copyright: (c) 2021, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
using namespace System.Management.Automation
using namespace System.Management.Automation.Host
using namespace System.Runtime.InteropServices
$typeParams = @{
TypeDefinition = @'
using Microsoft.Win32.SafeHandles;
@jborean93
jborean93 / Get-ExtendedAttribute.ps1
Created April 14, 2021 22:26
Gets extended attributes for a file on an NTFS volume
View Get-ExtendedAttribute.ps1
# Copyright: (c) 2021, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
class EncodingTransformAttribute : Management.Automation.ArgumentTransformationAttribute {
[object] Transform([Management.Automation.EngineIntrinsics]$engineIntrinsics, [object]$InputData) {
$outputData = switch ($InputData) {
{ $_ -is [Text.Encoding] } { $_ }
{ $_ -is [string] } {
switch ($_) {
@jborean93
jborean93 / Get-ServiceCertStore.ps1
Created March 2, 2021 04:42
Opens an X509 store for an NT Service account
View Get-ServiceCertStore.ps1
# Copyright: (c) 2021, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function Get-ServiceCertStore {
<#
.SYNOPSIS
Open an X509 store to a service account.
.DESCRIPTION
Opens an X509 store to the NT SERVICE account specified. The X509 store can be used to then add/remove/enumerate