Alex Clark Reality9

Reality9 / WMI_attack_detection.ps1

Created May 22, 2017 13:39 — forked from mattifestation/WMI_attack_detection.ps1

BlueHat 2016 - WMI attack detection demo

	#region Scriptblocks that will execute upon alert trigger
	$LateralMovementDetected = {
	$Event = $EventArgs.NewEvent

	$EventTime = [DateTime]::FromFileTime($Event.TIME_CREATED)

	$MethodName = $Event.MethodName
	$Namespace = $Event.Namespace
	$Object = $Event.ObjectPath
	$User = $Event.User

Reality9 / autodump_powershell_process.ps1

Created October 1, 2016 00:27 — forked from mattifestation/autodump_powershell_process.ps1

Automatically capture a full PowerShell memory dump upon any PowerShell host process termination

	$EventFilterArgs = @{
	EventNamespace = 'root/cimv2'
	Name = 'PowerShellProcessStarted'
	Query = 'SELECT FileName, ProcessID FROM Win32_ModuleLoadTrace WHERE FileName LIKE "%System.Management.Automation%.dll"'
	QueryLanguage = 'WQL'
	}

	$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $EventFilterArgs

	$CommandLineConsumerArgs = @{