vector-sec

Function ToString(rabyt,datatype)
    With CreateObject("MSXML2.DOMDocument")
        .LoadXML "<root />"
        .DocumentElement.DataType = datatype
        .DocumentElement.nodeTypedValue = rabyt
        ToString = Replace(.DocumentElement.text, vbLf, "")
    End With
End Function

Function ToSHA1HMAC(sTextToHash, sSharedSecretKey)

vector-sec

#requires -version 2

<#

    PowerSploit File: PowerView.ps1
    Author: Will Schroeder (@harmj0y)
    License: BSD 3-Clause
    Required Dependencies: None
    Optional Dependencies: None

vector-sec

### Keybase proof

I hereby claim:

  * I am vector-sec on github.
  * I am vector_sec (https://keybase.io/vector_sec) on keybase.
  * I have a public key whose fingerprint is 374D C736 0AC6 1C4A 8605  73C4 39B3 4B9B AED1 83D8

To claim this, I am signing this object:

vector-sec

using System;
using System.IO;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;

//Add For PowerShell Invocation
using System.Collections.ObjectModel;
using System.Management.Automation;

vector-sec

function Create-LNKPayload{
<#
    .SYNOPSIS

        Generates a malicous LNK file

    .PARAMETER LNKName

        Name of the LNK file you want to create. 

vector-sec

function Get-Doppelgangers
{
    <# 
    .SYNOPSIS 
    
    Detects use of NTFS transactions for stealth/evasion, aka 'Process Doppelganging'
     
    Author: Joe Desimone (@dez_) 
    License: BSD 3-Clause 
    

vector-sec

### Keybase proof

I hereby claim:

  * I am vector-sec on github.
  * I am vector_sec (https://keybase.io/vector_sec) on keybase.
  * I have a public key whose fingerprint is 45F7 FBFB 85BC 9C5D 26AF  FA50 CDD7 1C71 4152 0611

To claim this, I am signing this object:

vector-sec

$APIKey = 'KEY'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = "https://www.example.com/api/v1/process?q=process_name:certutil.exe"
$hdrs = @{}
$hdrs.Add("X-Auth-Token",$APIKey)
$response = Invoke-RestMethod -Uri $url -Headers $hdrs 


for($i =0; $i -lt $response.total_results; $i++)
{

vector-sec

function Get-InjectedThread
{
    <# 
    
    .SYNOPSIS 
    
    Looks for threads that were created as a result of code injection.
    
    .DESCRIPTION
    

vector-sec

Function ToString(rabyt,datatype)
  With CreateObject("MSXML2.DOMDocument")
    .LoadXML "<root />"
    .DocumentElement.DataType = datatype
    .DocumentElement.nodeTypedValue = rabyt
    ToString = Replace(.DocumentElement.text, vbLf, "")
  End With
End Function

Function ToSHA1HMAC(sTextToHash, sSharedSecretKey)