Simulate Linux's SUDO in PowerShell

To start a notepad.exe process as normal user:

c:\> notepad.exe

To start a notepad.exe process as normal user with PowerShell:

PS> Start-Process notepad

To open a file as Administrator with PowerShell:

Start-Process 'notepad' -Verb runAs -ArgumentList c:\windows\system32\drivers\etc\hosts

To simulate 'sudo' with PowerShell Cmdlet

-----------8<------------------

function sudo
{
  if ($args.Count -gt 0)
  {
    $lastIndex = $args.Count-1
    $programName = $args[0]
    if ($args.Count -gt 1)
    {
      $programArgs = $args[1 .. $lastIndex]
    }
    Start-Process $programName -Verb runAs -ArgumentList $programArgs
  }
  else
  {
    if ($env:WT_SESSION) {
      Start-Process "wt.exe" -Verb runAs
    }
    elseif ($PSVersionTable.PSEdition -eq 'Core')
    {
      Start-Process "$PSHOME\pwsh.exe" -Verb runAs
    }
    elseif ($PSVersionTable.PSEdition -eq 'Desktop')
    {
      Start-Process "$PSHOME\powershell.exe" -Verb runAs
    }
  }
}

Set-Alias -Name su -Value sudo

-----------8<------------------

To use the cmdlet:

PS> sudo notepad c:\windows\system32\drivers\etc\hosts

Links:

• 如何在 Windows 的 PowerShell 模擬 Linux 環境下的 sudo 命令
  

Weather at CmdLine

Check or curl your weather at cmdline with :

$ curl -s wttr.in/Melbourne?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"
Melbourne:⛅️  Partly cloudy +15°C/+14°C 59% ↑31km/h 🌗 UV:3/12 1016hPa

$ curl -s wttr.in/New+York?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"
New+York:☀️   Clear +1°C/-3°C 56% ↓15km/h 🌗 UV:1/12 1022hPa

PS> Invoke-RestMEthod  'https://wttr.in/New+York?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"'
New+York:☀️   Clear +1°C/-3°C 56% ↓15km/h 🌗 UV:1/12 1022hPa

Links:

• https://wttr.in/
  

16 Basic PowerShell Cmdlets

Get to know Windows PowerShell better with these 16 Best PowerShell Commands (Cmdlets) You Must Know.

Reset your Windows Firewall settings

Reset Windows Firewall to its defaults, at command prompt.

Open Command Prompt as administrator, and run the following command:

netsh advfirewall reset

Reset Windows Firewall to its defaults, using PowerShell.

Open PowerShell as administrator, and run the following command:

(New-Object -ComObject HNetCfg.FwPolicy2).RestoreLocalFirewallDefaults()

Links:

• How to reset your Windows Firewall settings (4 methods)
  

Active Directory Security Assessment with PowerShell

Krishna has a security assessment script that pulls important security facts from Active Directory and generates nicely viewable reports in HTML format by highlighting the spots that require attention. 

The powershell script covers:

• User account issues and Inactive accounts
• Users with ReversibleEncryptionPasswordArray
  
• Use Kerberos DES encryption types for this account
• Do not require Kerberos pre-authentication
• Review the domain password policy
• Tombstone lifetime and backups
• Unconstrained Kerberos delegation
• Scan SYSVOL for Group Policy Preference passwords
• Review KRBTGT account information
• Audit privileged AD groups

Security assessment helps to identify settings that do not meet the security standards. And remediation guidelines and best practices can be defined based on the assessment outcome.

 

Links:

• https://4sysops.com/archives/perform-active-directory-security-assessment-using-powershell/
• https://4sysops.com/wp-content/uploads/2022/01/AD_SecurityCheck.ps1
  

T0pCyber / Hawk

Hawk is an open-source, PowerShell-driven, community-developed tool network defenders can use to quickly and easily gather data from O365 and Azure for security investigations. Incident responders and network defenders can investigate specific user principals or the entire tenant. Data it provides include IP addresses and sign-in data. Additionally, Hawk can track IP usage for concurrent login situations.

Hawk users can review login details for administrator accounts and take the following steps.

1. Investigate high-value administrative accounts to detect anomalous.
2. Enable PowerShell logging.
3. Look for users with unusual sign-in locations, dates, and times.
4. Check permissions of service principals and applications in M365/Azure AD.
5. Detect the frequency of resource access from unusual places.
6. Review mailbox rules and recent mailbox rule changes.
   

Links:

• https://github.com/T0pCyber/hawk 
• https://myseq.blogspot.com/2021/03/crowdstrike-crt.html
• https://myseq.blogspot.com/2021/03/cisagov-sparrow.html
• Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments
• Detecting Abuse of Authentication Mechanisms 
  

CrowdStrike / CRT

CrowdStrike's Azure Reporting Tool can help analyzing Microsoft Azure AD and M365 environment in their Azure AD tenant and service configuration. 

This tool has minor overlap with Sparrow; it shows unique items, but it does not cover the same areas. CISA is highlighting this tool because it is one of the only free, open-source tools available to investigate this activity and could be used to complement Sparrow.

Links:

• https://github.com/CrowdStrike/CRT
  

cisagov / Sparrow

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

The tool is intended for use by incident responders, and focuses on the narrow scope of user and application activity endemic to identity and authentication based attacks seen recently in multiple sectors.

Sparrow.ps1 will check and install the required PowerShell modules on the analysis machine, check the unified audit log in Azure/M365 for certain indicators of compromise (IoC's), list Azure AD domains, and check Azure service principals and their Microsoft Graph API permissions to identify potential malicious activity. The tool then outputs the data into multiple CSV files that are located in the user's default home directory in a folder called 'ExportDir' (ie: Desktop/ExportDir).

Links:

• https://github.com/cisagov/Sparrow
  

Patching via Command Line

An interesting article about patching via command line. Below outlines the process and the command involves step-by-step.

• Create a list of server to be patched.

get-qadobject -sizelimit 0 -type computer | where {$_.osname -match "server"} | select name > c:\servers.txt

• Deploy the patch from a share folder.

psexec @serverlist.txt -c "\\File-Server\SecurityPatches$\MS08-067.exe /quiet /norestart /overwriteoem"

• Reboot the servers.

gc c:\servers.txt | ForEach-Object { gwmi win32_operatingsystem -ComputerName $_ | ForEach-Object { $_.reboot() }}

• Verify if any server failed the patching.

function Get-HotFix($server,$hotFixID) {
PROCESS{
$results = gwmi win32_quickfixengineering -computer $_ -filter "HotFixID='$hotFixID'"
if ($results) {
$results | select CSName,HotFixID,@{n="Installed";e={"Yes"}}
} else {
$results = "" | select CSName,HotFixID,Installed
$results.CSName=$_
$results.HotFixID=$hotFixID
$results.Installed="No"
$results
}
}
}
gc (Read-Host "Please provide path to server list file") | Get-HotFix -hotFixID (Read-Host "Hotfix ID") | ft -auto

>>>> See Poor Mans Patching with PSExec and PowerShell