PowerShellWatchlist/badshell.txt at master · secprentice/PowerShellWatchlist · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
add-exfiltration
add-persistence
add-scrnsavebackdoor
base64.b64decode
base64tostring
check-vm
chocolatey.org
copy-vss
create-multiplesessions
discover-psinterestingservices
discover-psmsexchangeservers
discover-psmssqlservers
dllinjection
do-exfiltration
download-execute-ps
downloadstring
enable-duplicatetoken
encodedcommand
execute-command-mssql
execute-dnstxt-code
execute-ontime
exploittable
extract-wifi-creds
find-allvulns
find-avsignature
find-ms
find-ms13081
find-psserviceaccounts
frombase64string
get-applicationhost
get-gpppassword
get-information
get-kerberospolicy
get-keystrokes
get-lsasecret
get-modifiablepath
get-modifiableregistryautorun
get-modifiablescheduledtaskfile
get-passhashes
get-psadforestinfo
get-psadforestkrbtgtinfo
get-regalwaysinstallelevated
get-regautologon
get-registryalwaysinstallelevated
get-registryautologon
get-serviceexeperms
get-serviceperms
get-serviceunquoted
get-timedscreenshot
get-unattendedinstallfiles
get-vaultcredential
get-webconfig
gupt-backdoor
gzipstream
http-backdoor
install-servicebinary
invoke-adsbackdoor
invoke-allchecks
invoke-bruteforce
invoke-callbackiex
invoke-createcertificate
invoke-credentialinjection
invoke-credentialsphish
invoke-decode
invoke-dllencode
invoke-dllinjection
invoke-encode
invoke-finddllhijack
invoke-findpathhijack
invoke-masscommand
invoke-massmimikatz
invoke-masssearch
invoke-masstemplate
invoke-masstokens
invoke-mimikatzwdigestdowngrade
invoke-networkrelay
invoke-ninjacopy
invoke-poshrathttp
invoke-poshrathttps
invoke-powershellicmp
invoke-powershelltcp
invoke-powershelludp
invoke-powershellwmi
invoke-psgcat
invoke-psgcatagent
invoke-psinject
invoke-serviceabuse
invoke-servicecmd
invoke-servicedisable
invoke-serviceenable
invoke-servicestart
invoke-servicestop
invoke-serviceuseradd
invoke-shellcode
invoke--shellcode
invoke-shellcodemsil
invoke-tokenmanipulation
invoke-wmicommand
mimikatz
net.webclient
net-webclient
new-elevatedpersistenceoption
new-object io.compression.deflatestream
new-userpersistenceoption
new-volumeshadowcopy
out-chm
out-excel
out-hta
out-java
out-minidump
out-shortcut
out-word
payload
port-scan
powercat
powerup
powerview
privesc
reflectivepeinjection
remove-persistence
remove-poshrat
remove-update
restore-servicebinary
restore-serviceexe
run-exeonremote
set-masterbootrecord
sherlock
stringtobase64
system.text.encoding
texttoexe
write-cmdservicebinary
write-servicebinary
write-serviceexe
write-serviceexecmd
write-useraddmsi
write-useraddservicebinary
VolumeShadowCopyTools
Get-MicrophoneAudio
Get-GPPAutologon
Get-WmiObject Win32_ComputerSystem
Find-ProcessDLLHijack
Get-System
Get-TimedScreenshot
New-Object System.Security.Cryptography.HMACSHA256
[System.Text.Encoding]::ASCII.GetString([System.Convert]
ConvertTo-Rc4ByteStream
Invoke-ShellCommand
{$o = $_.getowner(); if(-not $($o.User))
Set-MpPreference -DisableRealtimeMonitoring
DisableRealtimeMonitoring
Set-MpPreference