vector-sec

# Based off @mattifestation's example: https://gist.github.com/mattifestation/aff0cb8bf66c7f6ef44a
# Define the signature - i.e. __EventFilter
$EventFilterArgs = @{
    EventNamespace = 'root/cimv2'
    Name = 'HumanInterfaceDevice'
    Query = 'SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA "Win32_PointingDevice" OR TargetInstance ISA "Win32_KeyBoard"'
    QueryLanguage = 'WQL'
}

$InstanceArgs = @{

vector-sec

Function ToString(rabyt,datatype)
  With CreateObject("MSXML2.DOMDocument")
    .LoadXML "<root />"
    .DocumentElement.DataType = datatype
    .DocumentElement.nodeTypedValue = rabyt
    ToString = Replace(.DocumentElement.text, vbLf, "")
  End With
End Function

Function ToSHA1HMAC(sTextToHash, sSharedSecretKey)

vector-sec

Function ToString(rabyt,datatype)
    With CreateObject("MSXML2.DOMDocument")
        .LoadXML "<root />"
        .DocumentElement.DataType = datatype
        .DocumentElement.nodeTypedValue = rabyt
        ToString = Replace(.DocumentElement.text, vbLf, "")
    End With
End Function

Function ToSHA1HMAC(sTextToHash, sSharedSecretKey)

vector-sec

#requires -version 2

<#

    PowerSploit File: PowerView.ps1
    Author: Will Schroeder (@harmj0y)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None

vector-sec

#requires -version 2

<#

    PowerSploit File: PowerView.ps1
    Author: Will Schroeder (@harmj0y)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None

vector-sec

### Keybase proof

I hereby claim:

  * I am vector-sec on github.
  * I am vector_sec (https://keybase.io/vector_sec) on keybase.
  * I have a public key whose fingerprint is 374D C736 0AC6 1C4A 8605  73C4 39B3 4B9B AED1 83D8

To claim this, I am signing this object:

vector-sec

using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;

//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;

vector-sec

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

vector-sec

function Create-LNKPayload{
<#
    .SYNOPSIS

        Generates a malicous LNK file

    .PARAMETER LNKName

        Name of the LNK file you want to create. 

vector-sec

function Get-Token
{
    foreach($proc in (Get-Process))
    {
        if($proc.Id -ne 0 -and $proc.Id -ne 4)
        {
            try
            {
                $hProcess = OpenProcess -ProcessId $proc.Id -DesiredAccess PROCESS_QUERY_LIMITED_INFORMATION
            }