Mike SaintedRogue

SaintedRogue / Invoke-ProcessCheck.ps1

Created April 23, 2017 15:00

Look for suspicious process creation scenarios.

	#$global:processes
	#$global:process

	function Get-ProcessInfo
	{

	$wProc = Get-WmiObject win32_process -ComputerName localhost

	$processes = [PSCustomObject]@()

SaintedRogue / Get-InjectedThread.ps1

Created April 21, 2017 02:13 — forked from jaredcatkinson/Get-InjectedThread.ps1

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION