A collection of PowerShell commands and scripts for threat hunting, forensic investigation, and security analysis.
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsDomainGet-Process | Sort-Object CPU -Descending | Select-Object -First 10Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine | Format-Table -AutoSizeGet-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location | Format-Table -AutoSizeGet-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"Get-ScheduledTask | Where-Object {$_.State -eq "Ready"} | Select-Object TaskName, TaskPath, ActionsGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 4625} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 4673} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 1102} | Select-Object TimeCreated, MessageGet-NetTCPConnection | Sort-Object State | Format-Table -AutoSizeGet-NetTCPConnection | Where-Object {$_.RemoteAddress -notlike "192.168.*" -and $_.RemoteAddress -notlike "10.*"} | Format-Table -AutoSizeGet-NetIPAddress | Select-Object InterfaceAlias, IPAddressGet-ChildItem -Path C:\Users\ -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Sort-Object LastWriteTime -Descending$start = Get-Date "2025-04-21 00:00:00"
$end = Get-Date "2025-04-21 23:59:59"
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Force |
Where-Object {
($_.CreationTime -ge $start -and $_.CreationTime -le $end) -or
($_.LastWriteTime -ge $start -and $_.LastWriteTime -le $end)
} |
Select-Object FullName, CreationTime, LastWriteTime |
Export-Csv -Path "$env:USERPROFILE\Desktop\FileChanges-21-04-2025.csv" -NoTypeInformationGet-WmiObject Win32_Product | Select-Object Name, VersionGet-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | Where-Object {$_.Id -eq 1} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | Where-Object {$_.Id -eq 3} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security -MaxEvents 1000 | Export-Csv -Path C:\Logs\SecurityLogs.csv -NoTypeInformationFeel free to contribute by adding more PowerShell scripts for security investigations.
For suggestions or improvements, submit a pull request or open an issue.
Created by [Your Name] | Cybersecurity Enthusias
A collection of PowerShell commands and scripts for threat hunting, forensic investigation, and security analysis.
Get-ComputerInfo | Select-Object CsName, WindowsVersion, OsArchitecture, CsDomainGet-Process | Sort-Object CPU -Descending | Select-Object -First 10Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine | Format-Table -AutoSizeGet-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location | Format-Table -AutoSizeGet-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"Get-ScheduledTask | Where-Object {$_.State -eq "Ready"} | Select-Object TaskName, TaskPath, ActionsGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 4625} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 4673} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security | Where-Object {$_.Id -eq 1102} | Select-Object TimeCreated, MessageGet-NetTCPConnection | Sort-Object State | Format-Table -AutoSizeGet-NetTCPConnection | Where-Object {$_.RemoteAddress -notlike "192.168.*" -and $_.RemoteAddress -notlike "10.*"} | Format-Table -AutoSizeGet-NetIPAddress | Select-Object InterfaceAlias, IPAddressGet-ChildItem -Path C:\Users\ -Recurse | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Sort-Object LastWriteTime -DescendingGet-WmiObject Win32_Product | Select-Object Name, VersionGet-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | Where-Object {$_.Id -eq 1} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | Where-Object {$_.Id -eq 3} | Select-Object TimeCreated, MessageGet-WinEvent -LogName Security -MaxEvents 1000 | Export-Csv -Path C:\Logs\SecurityLogs.csv -NoTypeInformationFeel free to contribute by adding more PowerShell scripts for security investigations.
For suggestions or improvements, submit a pull request or open an issue.