Search Results for "detection"

PowerHub is a PowerShell-based automation framework designed to centralize and orchestrate common administrative tasks across Windows environments. It exposes a modular command set for inventorying systems, managing services, deploying packages, and executing remote commands with consistent logging and error handling. The project places emphasis on discoverability and reuse: scripts are organized into reusable modules and functions with clear parameter contracts so teams can compose...

PowerShell-Suite is a curated collection of PowerShell utility scripts and modules created to provide low-level Windows API access, process manipulation, debugging detection, security operations, and post-exploitation techniques directly from PowerShell. The project is licensed under BSD-3-Clause. Among its components, there are scripts like Invoke-Runas (to launch processes under alternate credentials via CreateProcessWithLogonW), Invoke-CreateProcess (to spawn processes with fine control over flags, window state, etc.), Detect-Debug (to detect kernel or user mode debugging environments), Get-Handles (to enumerate handles in a process via NtQuerySystemInformation), Get-TokenPrivs (to inspect privileges on process tokens), Get-Exports (to parse DLL exports without loading DLLs), Masquerade-PEB (to alter the PEB of a process to appear as a different process), and UAC-TokenMagic (a method to bypass UAC via token manipulation).

...Because the modules can be used to both demonstrate weaknesses and to exploit them, the project is typically referenced in threat emulation, penetration testing, and defensive research to understand attacker capabilities. Responsible use centers on authorized assessments: defenders use the toolkit to validate monitoring and detection, while operators apply its lessons to patch, harden, and instrument systems.