splunk-security_content/lookups/csv/malicious_powershell_strings.csv

1	command	toolkit	match	description
2	*Invoke-BitlockerCheck*	PrivescCheck	Invoke-BitlockerCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
3	*Invoke-CredentialGuardCheck*	PrivescCheck	Invoke-CredentialGuardCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
4	*Invoke-DllHijackingCheck*	PrivescCheck	Invoke-DllHijackingCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
5	*Invoke-DriverCoInstallersCheck*	PrivescCheck	Invoke-DriverCoInstallersCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
6	*Invoke-GPPPasswordCheck*	PrivescCheck	Invoke-GPPPasswordCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
7	*Invoke-HardenedUNCPathCheck*	PrivescCheck	Invoke-HardenedUNCPathCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
8	*Invoke-HijackableDllsCheck*	PrivescCheck	Invoke-HijackableDllsCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
9	*Invoke-HotFixCheck*	PrivescCheck	Invoke-HotFixCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
10	*Invoke-PrintNightmareCheck*	PrivescCheck	Invoke-PrintNightmareCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
11	*Invoke-RegistryAlwaysInstallElevatedCheck*	PrivescCheck	Invoke-RegistryAlwaysInstallElevatedCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
12	*Invoke-SccmCacheFolderCheck -Info*	PrivescCheck	Invoke-SccmCacheFolderCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
13	*Invoke-SCMPermissionsCheck*	PrivescCheck	Invoke-SCMPermissionsCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
14	*Invoke-SensitiveHiveFileAccessCheck*	PrivescCheck	Invoke-SensitiveHiveFileAccessCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
15	*Invoke-SensitiveHiveShadowCopyCheck*	PrivescCheck	Invoke-SensitiveHiveShadowCopyCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
16	*Invoke-ServicesUnquotedPathCheck*	PrivescCheck	Invoke-ServicesUnquotedPathCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
17	*Invoke-UnattendFilesCheck*	PrivescCheck	Invoke-UnattendFilesCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
18	*Invoke-WinlogonCheck*	PrivescCheck	Invoke-WinlogonCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
19	*Invoke-WsusConfigCheck*	PrivescCheck	Invoke-WsusConfigCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
20	*[mimikittenz.MemProcInspector]::*	Mimikittenz	[mimikittenz.MemProcInspector]::	post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
21	*Add-Exfiltration*	Nishang	Add-Exfiltration	Add data exfiltration capability to Gmail, Pastebin, a web server, and DNS to any script.
22	*Add-Persistence*	PowerSploit	Add-Persistence	Add persistence capabilities to a script.
23	*Add-RegBackdoor*	Nishang	Add-RegBackdoor	A backdoor which uses well known Debugger trick to execute payload with Sticky keys and Utilman (Windows key + U).
24	*Add-ScrnSaveBackdoor*	Nishang	Add-ScrnSaveBackdoor	A backdoor which can use Windows screen saver for remote command and script execution.
25	*Antak*	Nishang	Antak	Execute PowerShell scripts in memory, run commands, and download and upload files using this webshell.
26	*Connect-PowerCat*	PowerCat	Connect-PowerCat	Connects a client to a listener/server.
27	*DNS_TXT_Pwnage*	Nishang	DNS_TXT_Pwnage	A backdoor which can receive commands and PowerShell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries.
28	*Download_Execute*	Nishang	Download_Execute	Download an executable in text format, convert it to an executable, and execute.
29	*Download-Execute-PS*	Nishang	Download-Execute-PS	Download and execute a PowerShell script in memory.
30	*Enable-DuplicateToken*	Nishang	Enable-DuplicateToken	When SYSTEM privileges are required.
31	*Execute-Command-MSSQL*	Nishang	Execute-Command-MSSQL	Run PowerShell commands, native commands, or SQL commands on a MSSQL Server with sufficient privileges.
32	*Execute-DNSTXT-Code*	Nishang	Execute-DNSTXT-Code	Execute shellcode in memory using DNS TXT queries.
33	*Execute-OnTime*	Nishang	Execute-OnTime	A backdoor which can execute PowerShell scripts at a given time on a target.
34	*Find-AVSignature*	PowerSploit	Find-AVSignature	Locates single Byte AV signatures utilizing the same method as DSplit from class101.
35	*FireBuster*	Nishang	FireBuster	A pair of scripts for egress testing
36	*FireListener*	Nishang	FireListener	A pair of scripts for egress testing
37	*Get-GPPAutologon*	PowerSploit	Get-GPPAutologon	Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.
38	*Get-GPPPassword*	PowerSploit	Get-GPPPassword	Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
39	*Get-HttpStatus*	PowerSploit	Get-HttpStatus	Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.
40	*Get-Keystrokes*	PowerSploit	Get-Keystrokes	Logs keys pressed, time and the active window.
41	*Get-LSASecret*	Nishang	Get-LSASecret	Get LSA Secret from a target.
42	*Get-MicrophoneAudio*	PowerSploit	Get-MicrophoneAudio	Records audio from system microphone and saves to disk
43	*Get-PassHashes*	Nishang	Get-PassHashes	Get password hashes from a target.
44	*Get-PassHints*	Nishang	Get-PassHints	Get password hints of Windows users from a target.
45	*Get-SecurityPackages*	PowerSploit	Get-SecurityPackages	Enumerates all loaded security packages (SSPs).
46	*Get-TimedScreenshot*	PowerSploit	Get-TimedScreenshot	A function that takes screenshots at a regular interval and saves them to a folder.
47	*Get-VaultCredential*	PowerSploit	Get-VaultCredential	Displays Windows vault credential objects including cleartext web credentials.
48	*Get-VolumeShadowCopy*	PowerSploit	Get-VolumeShadowCopy	Lists the device paths of all local volume shadow copies.
49	*Get-WLAN-Keys*	Nishang	Get-WLAN-Keys	Get WLAN keys in plain text from a target.
50	*GetUserSPNS*	Multiple	GetUserSPNS	Enumerates SPNs for a given AD user
51	*Gupt-Backdoor*	Nishang	Gupt-Backdoor	A backdoor which can receive commands and scripts from a WLAN SSID without connecting to it.
52	*HTTP-Backdoor*	Nishang	HTTP-Backdoor	A backdoor which can receive instructions from third party websites and execute PowerShell scripts in memory.
53	*Install-SSP*	PowerSploit	Install-SSP	Installs a security support provider (SSP) dll.
54	*Invoke-ADSBackdoor*	Alternate Datastreams Backdoor	Invoke-ADSBackdoor	This script will obtain persistence on a Windows 7+ machine under both Standard and Administrative accounts by using two Alternate Data Streams.
55	*Invoke-AmsiBypass*	Nishang	Invoke-AmsiBypass	Implementation of publicly known methods to bypass/avoid AMSI.
56	*Invoke-BadPotato*	PowerSharpPack	Invoke-BadPotato	itm4ns Printspoofer in C#.
57	*Invoke-BetterSafetyKatz*	PowerSharpPack	Invoke-BetterSafetyKatz	Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.
58	*Invoke-BloodHound*	Multiple	Invoke-BloodHound	Enumerates AD, powershell version
59	*Invoke-CallbackIEX*	PowerBreach	Invoke-CallbackIEX	The location for the various callback mechanisms. Calls back and executes encoded payload.
60	*Invoke-Carbuncle*	PowerSharpPack	Invoke-Carbuncle	Tool for interacting with outlook interop during red team engagements
61	*Invoke-Certify*	PowerSharpPack	Invoke-Certify	Active Directory certificate abuse.
62	*Invoke-CredentialInjection*	PowerSploit	Invoke-CredentialInjection	Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).
63	*Invoke-CredentialsPhish*	Nishang	Invoke-CredentialsPhish	Trick a user into giving credentials in plain text.
64	*Invoke-DAFT*	PowerSharpPack	Invoke-DAFT	DAFT: Database Audit Framework & Toolkit
65	*Invoke-DeadUserBackdoor*	PowerBreach	Invoke-DeadUserBackdoor	Looks for dead user and calls back when does not exist. Admin-No, Firewall-No
66	*Invoke-DinvokeKatz*	PowerSharpPack	Invoke-DinvokeKatz	SharpSploit DInvoke to PE-Load into memory
67	*Invoke-DllInjection*	PowerSploit	Invoke-DllInjection	Injects a Dll into the process ID of your choosing.
68	*Invoke-EventLogBackdoor*	PowerBreach	Invoke-EventLogBackdoor	Monitors for failed RDP login attempts. Admin-Yes, Firewall-No, Auditing Reqd
69	*Invoke-Eyewitness*	PowerSharpPack	Invoke-Eyewitness	EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
70	*Invoke-FakeLogonScreen*	PowerSharpPack	Invoke-FakeLogonScreen	Fake Windows logon screen to steal passwords
71	*Invoke-Farmer*	PowerSharpPack	Invoke-Farmer	Farmer is a project for collecting NetNTLM hashes in a Windows domain. Farmer achieves this by creating a local WebDAV server that causes the WebDAV Mini Redirector to authenticate from any connecting clients.
72	*Invoke-Get-RBCD-Threaded*	PowerSharpPack	Invoke-Get-RBCD-Threaded	Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory environments
73	*Invoke-Gopher*	PowerSharpPack	Invoke-Gopher	C# tool to discover low hanging fruits.
74	*Invoke-Grouper*	PowerSharpPack	Invoke-Grouper	Find vulnerabilities in AD Group Policy
75	*Invoke-HandleKatz*	PowerSharpPack	Invoke-HandleKatz	PIC lsass dumper using cloned handles
76	*Invoke-HardenedUNCPathCheck*	PrivescCheck	Invoke-HardenedUNCPathCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
77	*Invoke-Interceptor*	Nishang	Invoke-Interceptor	A local HTTPS proxy for MITM attacks.
78	*Invoke-Internalmonologue*	PowerSharpPack	Invoke-Internalmonologue	Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
79	*Invoke-Inveigh*	PowerSharpPack	Invoke-Inveigh	Windows C# LLMNR/mDNS/NBNS/DNS/DHCPv6 spoofer/man-in-the-middle tool
80	*Invoke-InveighRelay*	Multiple	Invoke-InveighRelay	Windows C# LLMNR/mDNS/NBNS/DNS/DHCPv6 spoofer/man-in-the-middle tool
81	*Invoke-JSRatRegsvr*	Nishang	Invoke-JSRatRegsvr	An interactive PowerShell reverse shell over HTTP using regsvr32.exe.
82	*Invoke-JSRatRundll*	Nishang	Invoke-JSRatRundll	An interactive PowerShell reverse shell over HTTP using rundll32.exe.
83	*Invoke-Kerberoast*	Multiple	Invoke-Kerberoast	Enumerates all users with SPNs and solicits are Kerberos ticket for service
84	*Invoke-KrbRelay*	PowerSharpPack	Invoke-KrbRelay	Framework for Kerberos relaying
85	*Invoke-LdapSignCheck*	PowerSharpPack	Invoke-LdapSignCheck	C# project to check LDAP signing.
86	*Invoke-Lockless*	PowerSharpPack	Invoke-Lockless	Lockless allows for the copying of locked files.
87	*Invoke-LoopBackdoor*	PowerBreach	Invoke-LoopBackdoor	Callsback on set interval. Admin-No, Firewall-No
88	*Invoke-MalSCCM*	PowerSharpPack	Invoke-MalSCCM	This tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server. Typically deployments of SCCM will either have the management server and the primary server on the same host, in which case the host returned from the locate command can be used as the primary server.
89	*Invoke-Mimikatz*	PowerSploit	Invoke-Mimikatz	Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to extract sensitive credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
90	*Invoke-Mimikittenz*	Nishang	Invoke-Mimikittenz	Extract juicy information from target process (like browsers) memory using regex.
91	*Invoke-NanoDump*	PowerSharpPack	Invoke-NanoDump	Dump LSASS like you mean it
92	*Invoke-NetworkRelay *	Nishang	Invoke-NetworkRelay	Create network relays between computers.
93	*Invoke-Nightmare*	PrintNightmare	Invoke-Nightmare	Used to exploit the PrintNightmare vulnerability
94	*Invoke-NinjaCopy*	PowerSploit	Invoke-NinjaCopy	Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
95	*Invoke-Obfuscation*	Invoke-Obfuscation	Invoke-Obfuscation	Provides various methods of obfuscating powershell commands
96	*Invoke-OxidResolver*	PowerSharpPack	Invoke-OxidResolver	IOXIDResolver from AirBus Security/PingCastle
97	*Invoke-P0wnedshell*	PowerSharpPack	Invoke-P0wnedshell	PowerShell Runspace Post Exploitation Toolkit
98	*Invoke-P0wnedshellx86*	PowerSharpPack	Invoke-P0wnedshellx86	PowerShell Runspace Post Exploitation Toolkit
99	*Invoke-PortBindBackdoor*	PowerBreach	Invoke-PortBindBackdoor	Binds to TCP Port. Admin-No, Firewall-Yes
100	*Invoke-PortKnockBackdoor*	PowerBreach	Invoke-PortKnockBackdoor	Starts sniffer looking for trigger. Admin-Yes, Firewall-Yes
101	*Invoke-Portscan*	PowerSploit	Invoke-Portscan	Does a simple port scan using regular sockets, based (pretty) loosely on nmap.
102	*Invoke-PoshRatHttp*	Nishang	Invoke-PoshRatHttp	Reverse interactive PowerShell over HTTP or HTTPS.
103	*Invoke-Postdump*	PowerSharpPack	Invoke-Postdump	Another tool to perform minidump of LSASS process using few technics to avoid detection.
104	*Invoke-PowerShellIcmp*	Nishang	Invoke-PowerShellIcmp	An interactive PowerShell reverse shell over ICMP.
105	*Invoke-PowerShellTcp*	Nishang	Invoke-PowerShellTcp	An interactive PowerShell reverse connect or bind shell
106	*Invoke-PowerShellTcpOneLine*	Nishang	Invoke-PowerShellTcpOneLine	Stripped down version of Invoke-PowerShellTcp. Also contains, a skeleton version which could fit in two tweets.
107	*Invoke-PowerShellTcpOneLineBind*	Nishang	Invoke-PowerShellTcpOneLineBind	Bind version of Invoke-PowerShellTcpOneLine.
108	*Invoke-PowerShellUdp*	Nishang	Invoke-PowerShellUdp	An interactive PowerShell reverse connect or bind shell over UDP
109	*Invoke-PowerShellUdpOneLine*	Nishang	Invoke-PowerShellUdpOneLine	Stripped down version of Invoke-PowerShellUdp.
110	*Invoke-PowerShellWmi*	Nishang	Invoke-PowerShellWmi	Interactive PowerShell using WMI.
111	*Invoke-PPLDump*	PowerSharpPack	Invoke-PPLDump	Dump the memory of a PPL with a userland exploit
112	*Invoke-Psexec*	Multiple	Invoke-Psexec	Powershell version of PSExec
113	*Invoke-PsGcat*	Nishang	Invoke-PsGcat	Send commands and scripts to specifed Gmail account to be executed by Invoke-PsGcatAgent
114	*Invoke-PsGcatAgent*	Nishang	Invoke-PsGcatAgent	Execute commands and scripts sent by Invoke-PsGcat.
115	*Invoke-PsUACme*	Nishang	Invoke-PsUACme	Bypass UAC.
116	*Invoke-ReflectivePEInjection*	PowerSploit	Invoke-ReflectivePEInjection	Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
117	*Invoke-ResolverBackdoor*	PowerBreach	Invoke-ResolverBackdoor	Resolves name to decide when to callback. Admin-No, Firewall-No
118	*Invoke-ReverseDnsLookup*	PowerSploit	Invoke-ReverseDnsLookup	Scans an IP address range for DNS PTR records.
119	*Invoke-Rubeus*	PowerSharpPack	Invoke-Rubeus	Rubeus is a C# toolset for raw Kerberos interaction and abuses.
120	*Invoke-SafetyKatz*	PowerSharpPack	Invoke-SafetyKatz	SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader I modified this one again with my own obfuscated Mimikatz Version.
121	*Invoke-SauronEye*	PowerSharpPack	Invoke-SauronEye	Search tool to find specific files containing specific words, i.e. files containing passwords.
122	*Invoke-SccmCacheFolderCheck*	PrivescCheck	Invoke-SccmCacheFolderCheck	PrivescCheck is a tool built in Powershell used to enumerate common Windows configuration issues that can be leveraged for local privilege escalation
123	*Invoke-SCShell*	PowerSharpPack	Invoke-SCShell	Fileless lateral movement tool that relies on ChangeServiceConfigA to run command.
124	*Invoke-Seatbelt*	PowerSharpPack	Invoke-Seatbelt	Seatbelt is a C# project that performs a number of security oriented host-survey safety checks relevant from both offensive and defensive security perspectives.
125	*Invoke-SessionGopher*	Nishang	Invoke-SessionGopher	Identify admin jump-boxes and/or computers used to access Unix machines.
126	*Invoke-ShadowSpray*	PowerSharpPack	Invoke-ShadowSpray	A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain.
127	*Invoke-SharpAllowedToAct*	PowerSharpPack	Invoke-SharpAllowedToAct	Computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)
128	*Invoke-SharpBlock*	PowerSharpPack	Invoke-SharpBlock	A method of bypassing EDR's active projection DLL's by preventing entry point exection.
129	*Invoke-SharpBypassUAC*	PowerSharpPack	Invoke-SharpBypassUAC	C# tool for UAC bypasses
130	*Invoke-SharpChrome*	PowerSharpPack	Invoke-SharpChrome	SharpChrome is a .NET 2.0 CLR project to retrieve data from Google Chrome
131	*Invoke-SharpChromium*	PowerSharpPack	Invoke-SharpChromium	.NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
132	*Invoke-SharpClipboard*	PowerSharpPack	Invoke-SharpClipboard	C# Clipboard Monitor
133	*Invoke-SharpCloud*	PowerSharpPack	Invoke-SharpCloud	Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.
134	*Invoke-SharpDPAPI*	PowerSharpPack	Invoke-SharpDPAPI	SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
135	*Invoke-SharpDump*	PowerSharpPack	Invoke-SharpDump	SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
136	*Invoke-SharPersist*	PowerSharpPack	Invoke-SharPersist	Windows persistence toolkit written in C#.
137	*Invoke-SharpGPO-RemoteAccessPolicies*	PowerSharpPack	Invoke-SharpGPO-RemoteAccessPolicies	A C# tool for enumerating remote access policies through group policy.
138	*Invoke-SharpGPOAbuse*	PowerSharpPack	Invoke-SharpGPOAbuse	SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
139	*Invoke-SharpHandler*	PowerSharpPack	Invoke-SharpHandler	This project reuses open handles to lsass to parse or minidump lsass, therefore you don't need to use your own lsass handle to interact with it.
140	*Invoke-SharpHide*	PowerSharpPack	Invoke-SharpHide	Tool to create hidden registry keys.
141	*Invoke-Sharphound*	PowerSharpPack	Invoke-Sharphound	C# Data Collector for the BloodHound Project
142	*Invoke-SharpImpersonation*	PowerSharpPack	Invoke-SharpImpersonation	SharpImpersonation - A User Impersonation tool - via Token or Shellcode injection.
143	*Invoke-SharpImpersonationNoSpace*	PowerSharpPack	Invoke-SharpImpersonationNoSpace	SharpImpersonation - A User Impersonation tool - via Token or Shellcode injection.
144	*Invoke-SharpKatz*	PowerSharpPack	Invoke-SharpKatz	C# Port of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands.
145	*Invoke-SharpLdapRelayScan*	PowerSharpPack	Invoke-SharpLdapRelayScan	C# Port of LdapRelayScan
146	*Invoke-Sharplocker*	PowerSharpPack	Invoke-Sharplocker	SharpLocker helps get current user credentials by popping a fake Windows lock screen, all output is sent to Console which works perfect for Cobalt Strike.
147	*Invoke-SharpLoginPrompt*	PowerSharpPack	Invoke-SharpLoginPrompt	This Program creates a login prompt to gather username and password of the current user. This project allows red team to phish username and password of the current user without touching lsass and having adminitrator credentials on the system.
148	*Invoke-SharpMove*	PowerSharpPack	Invoke-SharpMove	.NET Project for performing Authenticated Remote Execution.
149	*Invoke-SharpPrinter*	PowerSharpPack	Invoke-SharpPrinter	Discover Printers + check for vulns
150	*Invoke-SharpPrintNightmare*	PowerSharpPack	Invoke-SharpPrintNightmare	C# implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
151	*Invoke-SharpRDP*	PowerSharpPack	Invoke-SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution.
152	*Invoke-SharpSCCM*	PowerSharpPack	Invoke-SharpSCCM	A C# utility for interacting with SCCM
153	*Invoke-SharpSecDump*	PowerSharpPack	Invoke-SharpSecDump	.Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py.
154	*Invoke-Sharpshares*	PowerSharpPack	Invoke-Sharpshares	Enumerate all network shares in the current domain. Also, can resolve names to IP addresses.
155	*Invoke-SharpSniper*	PowerSharpPack	Invoke-SharpSniper	Find specific users in active directory via their username and logon IP address
156	*Invoke-Sharpsploit_nomimi*	PowerSharpPack	Invoke-Sharpsploit_nomimi	SharpSploit is a .NET post-exploitation library written in C#.
157	*Invoke-SharpSploit*	PowerSharpPack	Invoke-SharpSploit	SharpSploit is a .NET post-exploitation library written in C#.
158	*Invoke-SharpSpray*	PowerSharpPack	Invoke-SharpSpray	SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.
159	*Invoke-SharpSSDP*	PowerSharpPack	Invoke-SharpSSDP	SSDP Service Discovery
160	*Invoke-SharpStay*	PowerSharpPack	Invoke-SharpStay	.NET project for installing Persistence
161	*Invoke-SharpUp*	PowerSharpPack	Invoke-SharpUp	SharpUp is a C# port of various PowerUp functionality.
162	*Invoke-Sharpview*	PowerSharpPack	Invoke-Sharpview	C# implementation of harmj0y's PowerView
163	*Invoke-SharpWatson*	PowerSharpPack	Invoke-SharpWatson	Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
164	*Invoke-Sharpweb*	PowerSharpPack	Invoke-Sharpweb	.NET 2.0 CLR project to retrieve saved browser credentials from Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge.
165	*Invoke-SharpWSUS*	PowerSharpPack	Invoke-SharpWSUS	SharpWSUS is a CSharp tool for lateral movement through WSUS. There is a corresponding blog (https://labs.nettitude.com/blog/introducing-sharpwsus/) which has more detailed information about the tooling, use case and detection.
166	*Invoke-Shellcode*	PowerSploit	Invoke-Shellcode	Injects shellcode into the process ID of your choosing or within PowerShell locally.
167	*Invoke-SMBExec*	Multiple	Invoke-SMBExec	Process execution via SMB
168	*Invoke-Snaffler*	PowerSharpPack	Invoke-Snaffler	A tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax ).
169	*Invoke-Spoolsample*	PowerSharpPack	Invoke-Spoolsample	PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.
170	*Invoke-SSIDExfil*	Nishang	Invoke-SSIDExfil	Exfiltrate information like user credentials, using WLAN SSID.
171	*Invoke-StandIn*	PowerSharpPack	Invoke-StandIn	StandIn is a small .NET35/45 AD post-exploitation toolkit
172	*Invoke-StickyNotesExtract*	PowerSharpPack	Invoke-StickyNotesExtract	Extracts data from the Windows Sticky Notes database. Works on Windows 10 Build 1607 and higher. This project doesn't rely on any external dependencies.
173	*Invoke-Tater*	Multiple	Invoke-Tater	If the host is vulnerable to the Hot Potato privilege escalation, will run commands as System, as we will be able to impersonate the SYSTEM account
174	*Invoke-Thunderfox*	PowerSharpPack	Invoke-Thunderfox	Retrieves data (contacts, emails, history, cookies and credentials) from Thunderbird and Firefox.
175	*Invoke-TokenManipulation*	PowerSploit	Invoke-TokenManipulation	Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.
176	*Invoke-Tokenvator*	PowerSharpPack	Invoke-Tokenvator	A tool to elevate privilege with Windows Tokens
177	*Invoke-UrbanBishop*	PowerSharpPack	Invoke-UrbanBishop	Creates a local RW section in UrbanBishop and then maps that section as RX into a remote process. Shellcode loading made easy.
178	*Invoke-Whisker*	PowerSharpPack	Invoke-Whisker	Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding Shadow Credentials to the target account.
179	*Invoke-winPEAS*	PowerSharpPack	Invoke-winPEAS	Check the Local Windows Privilege Escalation checklist from book.hacktricks.xyz
180	*Invoke-WireTap*	PowerSharpPack	Invoke-WireTap	.NET 4.0 Project to interact with video, audio and keyboard hardware.
181	*Invoke-WmiCommand*	PowerSploit	Invoke-WmiCommand	Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.
182	*Invoke-WMIExec*	Multiple	Invoke-WMIExec	Process execution via WMI
183	*kerberos::*	Multiple	kerberos::	Mimikatz exploit commands
184	*Keylogger*	Nishang	Keylogger	Log keystrokes from a target.
185	*lsadump::*	Multiple	lsadump::	Mimikatz exploit commands
186	*Mayhem*	PowerSploit	Mayhem	Cause general mayhem with PowerShell.
187	*Mount-VolumeShadowCopy*	PowerSploit	Mount-VolumeShadowCopy	Mounts a volume shadow copy.
188	*New-ElevatedPersistenceOption*	PowerSploit	New-ElevatedPersistenceOption	Configure elevated persistence options for the Add-Persistence function.
189	*New-UserPersistenceOption*	PowerSploit	New-UserPersistenceOption	Configure user-level persistence options for the Add-Persistence function.
190	*New-VolumeShadowCopy*	PowerSploit	New-VolumeShadowCopy	Creates a new volume shadow copy.
191	*Out-CompressedDll*	PowerSploit	Out-CompressedDll	Compresses, Base-64 encodes, and outputs generated code to load a managed dll in memory.
192	*Out-EncodedCommand*	PowerSploit	Out-EncodedCommand	Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.
193	*Out-EncryptedScript*	PowerSploit	Out-EncryptedScript	Encrypts text files/scripts.
194	*Out-Minidump*	PowerSploit	Out-Minidump	Generates a full-memory minidump of a process.
195	*Out-RundllCommand*	Nishang	Out-RundllCommand	Execute PowerShell commands and scripts or a reverse PowerShell session using rundll32.exe.
196	*Powerpreter*	Nishang	Powerpreter	Powerpreter
197	*PowerUp*	PowerSploit	PowerUp	Clearing house of common privilege escalation checks, along with some weaponization vectors.
198	*PowerView*	PowerSploit	PowerView	PowerView is series of functions that performs network and Windows domain enumeration and exploitation.
199	*Remove-ADSBackdoor*	Alternate Datastreams Backdoor	Remove-ADSBackdoor	This script will obtain persistence on a Windows 7+ machine under both Standard and Administrative accounts by using two Alternate Data Streams.
200	*Remove-Comment*	PowerSploit	Remove-Comment	Strips comments and extra whitespace from a script.
201	*Remove-Persistence*	Nishang	Remove-Persistence	Remote persistence added by the Add-Persistence script.
202	*Remove-PoshRat*	Nishang	Remove-PoshRat	Clean the system after using Invoke-PoshRatHttps
203	*Remove-Update*	Nishang	Remove-Update	Introduce vulnerabilities by removing patches.
204	*Remove-VolumeShadowCopy*	PowerSploit	Remove-VolumeShadowCopy	Deletes a volume shadow copy.
205	*Run-EXEonRemote*	Nishang	Run-EXEonRemote	Copy and execute an executable on multiple machines.
206	*sekurlsa::*	Multiple	sekurlsa::	Mimikatz exploit commands
207	*Set-CriticalProcess*	PowerSploit	Set-CriticalProcess	Causes your machine to blue screen upon exiting PowerShell.
208	*Set-DCShadowPermissions*	Nishang	Set-DCShadowPermissions	Modify AD objects to provide minimal permissions required for DCShadow.
209	*Set-MasterBootRecord*	PowerSploit	Set-MasterBootRecord	Proof of concept code that overwrites the master boot record with the message of your choice.
210	*Set-RemotePSRemoting*	Nishang	Set-RemotePSRemoting	Modify permissions of PowerShell remoting to allow access to a non-admin user.
211	*Set-RemoteWMI*	Nishang	Set-RemoteWMI	Modify permissions of DCOM and WMI namespaces to allow access to a non-admin user.
212	*Sherlock*	Multiple	Sherlock	PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities
213	*Show-TargetScreen*	Nishang	Show-TargetScreen	Connect back and Stream target screen using MJPEG.
214	*Start-PowerCat*	PowerCat	Start-PowerCat	Starts a listener/server.