splunk-security_content/lookups/malicious_powershell_strings.csv

1	command	toolkit	match	description
2	*Invoke-DllInjection*	PowerSploit	Invoke-DllInjection	Injects a Dll into the process ID of your choosing.
3	*Invoke-ReflectivePEInjection*	PowerSploit	Invoke-ReflectivePEInjection	Reflectively loads a Windows PE file (DLL/EXE) in to the powershell process, or reflectively injects a DLL in to a remote process.
4	*Invoke-Shellcode*	PowerSploit	Invoke-Shellcode	Injects shellcode into the process ID of your choosing or within PowerShell locally.
5	*Invoke-WmiCommand*	PowerSploit	Invoke-WmiCommand	Executes a PowerShell ScriptBlock on a target computer and returns its formatted output using WMI as a C2 channel.
6	*Out-EncodedCommand*	PowerSploit	Out-EncodedCommand	Compresses, Base-64 encodes, and generates command-line output for a PowerShell payload script.
7	*Out-CompressedDll*	PowerSploit	Out-CompressedDll	Compresses, Base-64 encodes, and outputs generated code to load a managed dll in memory.
8	*Out-EncryptedScript*	PowerSploit	Out-EncryptedScript	Encrypts text files/scripts.
9	*Remove-Comment*	PowerSploit	Remove-Comment	Strips comments and extra whitespace from a script.
10	*New-UserPersistenceOption*	PowerSploit	New-UserPersistenceOption	Configure user-level persistence options for the Add-Persistence function.
11	*New-ElevatedPersistenceOption*	PowerSploit	New-ElevatedPersistenceOption	Configure elevated persistence options for the Add-Persistence function.
12	*Add-Persistence*	PowerSploit	Add-Persistence	Add persistence capabilities to a script.
13	*Install-SSP*	PowerSploit	Install-SSP	Installs a security support provider (SSP) dll.
14	*Get-SecurityPackages*	PowerSploit	Get-SecurityPackages	Enumerates all loaded security packages (SSPs).
15	*Find-AVSignature*	PowerSploit	Find-AVSignature	Locates single Byte AV signatures utilizing the same method as DSplit from class101.
16	*Invoke-TokenManipulation*	PowerSploit	Invoke-TokenManipulation	Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread.
17	*Invoke-CredentialInjection*	PowerSploit	Invoke-CredentialInjection	Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).
18	*Invoke-NinjaCopy*	PowerSploit	Invoke-NinjaCopy	Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
19	*Invoke-Mimikatz*	PowerSploit	Invoke-Mimikatz	Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to extract sensitive credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
20	*Get-Keystrokes*	PowerSploit	Get-Keystrokes	Logs keys pressed, time and the active window.
21	*Get-GPPPassword*	PowerSploit	Get-GPPPassword	Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
22	*Get-GPPAutologon*	PowerSploit	Get-GPPAutologon	Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.
23	*Get-TimedScreenshot*	PowerSploit	Get-TimedScreenshot	A function that takes screenshots at a regular interval and saves them to a folder.
24	*New-VolumeShadowCopy*	PowerSploit	New-VolumeShadowCopy	Creates a new volume shadow copy.
25	*Get-VolumeShadowCopy*	PowerSploit	Get-VolumeShadowCopy	Lists the device paths of all local volume shadow copies.
26	*Mount-VolumeShadowCopy*	PowerSploit	Mount-VolumeShadowCopy	Mounts a volume shadow copy.
27	*Remove-VolumeShadowCopy*	PowerSploit	Remove-VolumeShadowCopy	Deletes a volume shadow copy.
28	*Get-VaultCredential*	PowerSploit	Get-VaultCredential	Displays Windows vault credential objects including cleartext web credentials.
29	*Out-Minidump*	PowerSploit	Out-Minidump	Generates a full-memory minidump of a process.
30	*Get-MicrophoneAudio*	PowerSploit	Get-MicrophoneAudio	Records audio from system microphone and saves to disk
31	*Mayhem*	PowerSploit	Mayhem	Cause general mayhem with PowerShell.
32	*Set-MasterBootRecord*	PowerSploit	Set-MasterBootRecord	Proof of concept code that overwrites the master boot record with the message of your choice.
33	*Set-CriticalProcess*	PowerSploit	Set-CriticalProcess	Causes your machine to blue screen upon exiting PowerShell.
34	*PowerUp*	PowerSploit	PowerUp	Clearing house of common privilege escalation checks, along with some weaponization vectors.
35	*Invoke-Portscan*	PowerSploit	Invoke-Portscan	Does a simple port scan using regular sockets, based (pretty) loosely on nmap.
36	*Get-HttpStatus*	PowerSploit	Get-HttpStatus	Returns the HTTP Status Codes and full URL for specified paths when provided with a dictionary file.
37	*PowerView*	PowerSploit	PowerView	PowerView is series of functions that performs network and Windows domain enumeration and exploitation.
38	*Invoke-ReverseDnsLookup*	PowerSploit	Invoke-ReverseDnsLookup	Scans an IP address range for DNS PTR records.
39	*Start-PowerCat*	PowerCat	Start-PowerCat	Starts a listener/server.
40	*Connect-PowerCat*	PowerCat	Connect-PowerCat	Connects a client to a listener/server.
41	*Invoke-Kerberoast*	Multiple	Invoke-Kerberoast	Enumerates all users with SPNs and solicits are Kerberos ticket for service
42	*Invoke-BloodHound*	Multiple	Invoke-BloodHound	Enumerates AD, powershell version
43	*Invoke-WMIExec*	Multiple	Invoke-WMIExec	Process execution via WMI
44	*Invoke-SMBExec*	Multiple	Invoke-SMBExec	Process execution via SMB
45	*Invoke-Tater*	Multiple	Invoke-Tater	If the host is vulnerable to the Hot Potato privilege escalation, will run commands as System, as we will be able to impersonate the SYSTEM account
46	*Invoke-InveighRelay*	Multiple	Invoke-InveighRelay	Windows C# LLMNR/mDNS/NBNS/DNS/DHCPv6 spoofer/man-in-the-middle tool
47	*GetUserSPNS*	Multiple	GetUserSPNS	Enumerates SPNs for a given AD user
48	*Sherlock*	Multiple	Sherlock	PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities
49	*Invoke-Psexec*	Multiple	Invoke-Psexec	Powershell version of PSExec
50	*sekurlsa::*	Multiple	sekurlsa::	Mimikatz exploit commands
51	*lsadump::*	Multiple	lsadump::	Mimikatz exploit commands
52	*kerberos::*	Multiple	kerberos::	Mimikatz exploit commands
53	*[mimikittenz.MemProcInspector]::*	Mimikittenz	[mimikittenz.MemProcInspector]::	post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory() in order to extract plain-text passwords from various target processes.
54	*Remove-ADSBackdoor*	Alternate Datastreams Backdoor	Remove-ADSBackdoor	This script will obtain persistence on a Windows 7+ machine under both Standard and Administrative accounts by using two Alternate Data Streams.
55	*Invoke-ADSBackdoor*	Alternate Datastreams Backdoor	Invoke-ADSBackdoor	This script will obtain persistence on a Windows 7+ machine under both Standard and Administrative accounts by using two Alternate Data Streams.
56	*Invoke-EventLogBackdoor*	PowerBreach	Invoke-EventLogBackdoor	Monitors for failed RDP login attempts. Admin-Yes, Firewall-No, Auditing Reqd
57	*Invoke-PortBindBackdoor*	PowerBreach	Invoke-PortBindBackdoor	Binds to TCP Port. Admin-No, Firewall-Yes
58	*Invoke-ResolverBackdoor*	PowerBreach	Invoke-ResolverBackdoor	Resolves name to decide when to callback. Admin-No, Firewall-No
59	*Invoke-PortKnockBackdoor*	PowerBreach	Invoke-PortKnockBackdoor	Starts sniffer looking for trigger. Admin-Yes, Firewall-Yes
60	*Invoke-LoopBackdoor*	PowerBreach	Invoke-LoopBackdoor	Callsback on set interval. Admin-No, Firewall-No
61	*Invoke-DeadUserBackdoor*	PowerBreach	Invoke-DeadUserBackdoor	Looks for dead user and calls back when does not exist. Admin-No, Firewall-No
62	*Invoke-CallbackIEX*	PowerBreach	Invoke-CallbackIEX	The location for the various callback mechanisms. Calls back and executes encoded payload.
63	*Invoke-Obfuscation*	Invoke-Obfuscation	Invoke-Obfuscation	Provides various methods of obfuscating powershell commands
64	*Set-DCShadowPermissions*	Nishang	Set-DCShadowPermissions	Modify AD objects to provide minimal permissions required for DCShadow.
65	*Antak*	Nishang	Antak	Execute PowerShell scripts in memory, run commands, and download and upload files using this webshell.
66	*HTTP-Backdoor*	Nishang	HTTP-Backdoor	A backdoor which can receive instructions from third party websites and execute PowerShell scripts in memory.
67	*DNS_TXT_Pwnage*	Nishang	DNS_TXT_Pwnage	A backdoor which can receive commands and PowerShell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries.
68	*Execute-OnTime*	Nishang	Execute-OnTime	A backdoor which can execute PowerShell scripts at a given time on a target.
69	*Gupt-Backdoor*	Nishang	Gupt-Backdoor	A backdoor which can receive commands and scripts from a WLAN SSID without connecting to it.
70	*Add-ScrnSaveBackdoor*	Nishang	Add-ScrnSaveBackdoor	A backdoor which can use Windows screen saver for remote command and script execution.
71	*Add-RegBackdoor*	Nishang	Add-RegBackdoor	A backdoor which uses well known Debugger trick to execute payload with Sticky keys and Utilman (Windows key + U).
72	*Set-RemoteWMI*	Nishang	Set-RemoteWMI	Modify permissions of DCOM and WMI namespaces to allow access to a non-admin user.
73	*Set-RemotePSRemoting*	Nishang	Set-RemotePSRemoting	Modify permissions of PowerShell remoting to allow access to a non-admin user.
74	*Invoke-AmsiBypass*	Nishang	Invoke-AmsiBypass	Implementation of publicly known methods to bypass/avoid AMSI.
75	*Enable-DuplicateToken*	Nishang	Enable-DuplicateToken	When SYSTEM privileges are required.
76	*Remove-Update*	Nishang	Remove-Update	Introduce vulnerabilities by removing patches.
77	*Invoke-PsUACme*	Nishang	Invoke-PsUACme	Bypass UAC.
78	*Download-Execute-PS*	Nishang	Download-Execute-PS	Download and execute a PowerShell script in memory.
79	*Download_Execute*	Nishang	Download_Execute	Download an executable in text format, convert it to an executable, and execute.
80	*Execute-Command-MSSQL*	Nishang	Execute-Command-MSSQL	Run PowerShell commands, native commands, or SQL commands on a MSSQL Server with sufficient privileges.
81	*Execute-DNSTXT-Code*	Nishang	Execute-DNSTXT-Code	Execute shellcode in memory using DNS TXT queries.
82	*Out-RundllCommand*	Nishang	Out-RundllCommand	Execute PowerShell commands and scripts or a reverse PowerShell session using rundll32.exe.
83	*Invoke-CredentialsPhish*	Nishang	Invoke-CredentialsPhish	Trick a user into giving credentials in plain text.
84	*FireBuster*	Nishang	FireBuster	A pair of scripts for egress testing
85	*FireListener*	Nishang	FireListener	A pair of scripts for egress testing
86	*Get-LSASecret*	Nishang	Get-LSASecret	Get LSA Secret from a target.
87	*Get-PassHashes*	Nishang	Get-PassHashes	Get password hashes from a target.
88	*Get-WLAN-Keys*	Nishang	Get-WLAN-Keys	Get WLAN keys in plain text from a target.
89	*Keylogger*	Nishang	Keylogger	Log keystrokes from a target.
90	*Get-PassHints*	Nishang	Get-PassHints	Get password hints of Windows users from a target.
91	*Show-TargetScreen*	Nishang	Show-TargetScreen	Connect back and Stream target screen using MJPEG.
92	*Invoke-Mimikittenz*	Nishang	Invoke-Mimikittenz	Extract juicy information from target process (like browsers) memory using regex.
93	*Invoke-SSIDExfil*	Nishang	Invoke-SSIDExfil	Exfiltrate information like user credentials, using WLAN SSID.
94	*Invoke-SessionGopher*	Nishang	Invoke-SessionGopher	Identify admin jump-boxes and/or computers used to access Unix machines.
95	*Invoke-Interceptor*	Nishang	Invoke-Interceptor	A local HTTPS proxy for MITM attacks.
96	*Run-EXEonRemote *	Nishang	Run-EXEonRemote	Copy and execute an executable on multiple machines.
97	*Invoke-NetworkRelay *	Nishang	Invoke-NetworkRelay	Create network relays between computers.
98	*Powerpreter*	Nishang	Powerpreter	Powerpreter
99	*Invoke-PsGcat*	Nishang	Invoke-PsGcat	Send commands and scripts to specifed Gmail account to be executed by Invoke-PsGcatAgent
100	*Invoke-PsGcatAgent*	Nishang	Invoke-PsGcatAgent	Execute commands and scripts sent by Invoke-PsGcat.
101	*Invoke-PowerShellTcp*	Nishang	Invoke-PowerShellTcp	An interactive PowerShell reverse connect or bind shell
102	*Invoke-PowerShellTcpOneLine*	Nishang	Invoke-PowerShellTcpOneLine	Stripped down version of Invoke-PowerShellTcp. Also contains, a skeleton version which could fit in two tweets.
103	*Invoke-PowerShellTcpOneLineBind*	Nishang	Invoke-PowerShellTcpOneLineBind	Bind version of Invoke-PowerShellTcpOneLine.
104	*Invoke-PowerShellUdp*	Nishang	Invoke-PowerShellUdp	An interactive PowerShell reverse connect or bind shell over UDP
105	*Invoke-PowerShellUdpOneLine*	Nishang	Invoke-PowerShellUdpOneLine	Stripped down version of Invoke-PowerShellUdp.
106	*Invoke-PoshRatHttp*	Nishang	Invoke-PoshRatHttp	Reverse interactive PowerShell over HTTP or HTTPS.
107	*Remove-PoshRat*	Nishang	Remove-PoshRat	Clean the system after using Invoke-PoshRatHttps
108	*Invoke-PowerShellWmi*	Nishang	Invoke-PowerShellWmi	Interactive PowerShell using WMI.
109	*Invoke-PowerShellIcmp*	Nishang	Invoke-PowerShellIcmp	An interactive PowerShell reverse shell over ICMP.
110	*Invoke-JSRatRundll*	Nishang	Invoke-JSRatRundll	An interactive PowerShell reverse shell over HTTP using rundll32.exe.
111	*Invoke-JSRatRegsvr*	Nishang	Invoke-JSRatRegsvr	An interactive PowerShell reverse shell over HTTP using regsvr32.exe.
112	*Add-Exfiltration*	Nishang	Add-Exfiltration	Add data exfiltration capability to Gmail, Pastebin, a web server, and DNS to any script.
113	*Remove-Persistence*	Nishang	Remove-Persistence	Remote persistence added by the Add-Persistence script.
114	*Invoke-BadPotato*	PowerSharpPack	Invoke-BadPotato	itm4ns Printspoofer in C#.
115	*Invoke-BetterSafetyKatz*	PowerSharpPack	Invoke-BetterSafetyKatz	Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.
116	*Invoke-Carbuncle*	PowerSharpPack	Invoke-Carbuncle	Tool for interacting with outlook interop during red team engagements
117	*Invoke-Certify*	PowerSharpPack	Invoke-Certify	Active Directory certificate abuse.
118	*Invoke-DAFT*	PowerSharpPack	Invoke-DAFT	DAFT: Database Audit Framework & Toolkit
119	*Invoke-DinvokeKatz*	PowerSharpPack	Invoke-DinvokeKatz	SharpSploit DInvoke to PE-Load into memory
120	*Invoke-Eyewitness*	PowerSharpPack	Invoke-Eyewitness	EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
121	*Invoke-FakeLogonScreen*	PowerSharpPack	Invoke-FakeLogonScreen	Fake Windows logon screen to steal passwords
122	*Invoke-Farmer*	PowerSharpPack	Invoke-Farmer	Farmer is a project for collecting NetNTLM hashes in a Windows domain. Farmer achieves this by creating a local WebDAV server that causes the WebDAV Mini Redirector to authenticate from any connecting clients.
123	*Invoke-Get-RBCD-Threaded*	PowerSharpPack	Invoke-Get-RBCD-Threaded	Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory environments
124	*Invoke-Gopher*	PowerSharpPack	Invoke-Gopher	C# tool to discover low hanging fruits.
125	*Invoke-Grouper*	PowerSharpPack	Invoke-Grouper	Find vulnerabilities in AD Group Policy
126	*Invoke-HandleKatz*	PowerSharpPack	Invoke-HandleKatz	PIC lsass dumper using cloned handles
127	*Invoke-Internalmonologue*	PowerSharpPack	Invoke-Internalmonologue	Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS
128	*Invoke-Inveigh*	PowerSharpPack	Invoke-Inveigh	Windows C# LLMNR/mDNS/NBNS/DNS/DHCPv6 spoofer/man-in-the-middle tool
129	*Invoke-KrbRelay*	PowerSharpPack	Invoke-KrbRelay	Framework for Kerberos relaying
130	*Invoke-LdapSignCheck*	PowerSharpPack	Invoke-LdapSignCheck	C# project to check LDAP signing.
131	*Invoke-Lockless*	PowerSharpPack	Invoke-Lockless	Lockless allows for the copying of locked files.
132	*Invoke-MalSCCM*	PowerSharpPack	Invoke-MalSCCM	This tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server. Typically deployments of SCCM will either have the management server and the primary server on the same host, in which case the host returned from the locate command can be used as the primary server.
133	*Invoke-NanoDump*	PowerSharpPack	Invoke-NanoDump	Dump LSASS like you mean it
134	*Invoke-OxidResolver*	PowerSharpPack	Invoke-OxidResolver	IOXIDResolver from AirBus Security/PingCastle
135	*Invoke-P0wnedshell*	PowerSharpPack	Invoke-P0wnedshell	PowerShell Runspace Post Exploitation Toolkit
136	*Invoke-P0wnedshellx86*	PowerSharpPack	Invoke-P0wnedshellx86	PowerShell Runspace Post Exploitation Toolkit
137	*Invoke-PPLDump*	PowerSharpPack	Invoke-PPLDump	Dump the memory of a PPL with a userland exploit
138	*Invoke-Postdump*	PowerSharpPack	Invoke-Postdump	Another tool to perform minidump of LSASS process using few technics to avoid detection.
139	*Invoke-Rubeus*	PowerSharpPack	Invoke-Rubeus	Rubeus is a C# toolset for raw Kerberos interaction and abuses.
140	*Invoke-SCShell*	PowerSharpPack	Invoke-SCShell	Fileless lateral movement tool that relies on ChangeServiceConfigA to run command.
141	*Invoke-SafetyKatz*	PowerSharpPack	Invoke-SafetyKatz	SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader I modified this one again with my own obfuscated Mimikatz Version.
142	*Invoke-SauronEye*	PowerSharpPack	Invoke-SauronEye	Search tool to find specific files containing specific words, i.e. files containing passwords.
143	*Invoke-Seatbelt*	PowerSharpPack	Invoke-Seatbelt	Seatbelt is a C# project that performs a number of security oriented host-survey safety checks relevant from both offensive and defensive security perspectives.
144	*Invoke-ShadowSpray*	PowerSharpPack	Invoke-ShadowSpray	A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain.
145	*Invoke-SharPersist*	PowerSharpPack	Invoke-SharPersist	Windows persistence toolkit written in C#.
146	*Invoke-SharpAllowedToAct*	PowerSharpPack	Invoke-SharpAllowedToAct	Computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity)
147	*Invoke-SharpBlock*	PowerSharpPack	Invoke-SharpBlock	A method of bypassing EDR's active projection DLL's by preventing entry point exection.
148	*Invoke-SharpBypassUAC*	PowerSharpPack	Invoke-SharpBypassUAC	C# tool for UAC bypasses
149	*Invoke-SharpChrome*	PowerSharpPack	Invoke-SharpChrome	SharpChrome is a .NET 2.0 CLR project to retrieve data from Google Chrome
150	*Invoke-SharpChromium*	PowerSharpPack	Invoke-SharpChromium	.NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
151	*Invoke-SharpClipboard*	PowerSharpPack	Invoke-SharpClipboard	C# Clipboard Monitor
152	*Invoke-SharpCloud*	PowerSharpPack	Invoke-SharpCloud	Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.
153	*Invoke-SharpDPAPI*	PowerSharpPack	Invoke-SharpDPAPI	SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
154	*Invoke-SharpDump*	PowerSharpPack	Invoke-SharpDump	SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
155	*Invoke-SharpGPO-RemoteAccessPolicies*	PowerSharpPack	Invoke-SharpGPO-RemoteAccessPolicies	A C# tool for enumerating remote access policies through group policy.
156	*Invoke-SharpGPOAbuse*	PowerSharpPack	Invoke-SharpGPOAbuse	SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
157	*Invoke-SharpHandler*	PowerSharpPack	Invoke-SharpHandler	This project reuses open handles to lsass to parse or minidump lsass, therefore you don't need to use your own lsass handle to interact with it.
158	*Invoke-SharpHide*	PowerSharpPack	Invoke-SharpHide	Tool to create hidden registry keys.
159	*Invoke-SharpImpersonation*	PowerSharpPack	Invoke-SharpImpersonation	SharpImpersonation - A User Impersonation tool - via Token or Shellcode injection.
160	*Invoke-SharpImpersonationNoSpace*	PowerSharpPack	Invoke-SharpImpersonationNoSpace	SharpImpersonation - A User Impersonation tool - via Token or Shellcode injection.
161	*Invoke-SharpKatz*	PowerSharpPack	Invoke-SharpKatz	C# Port of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands.
162	*Invoke-SharpLdapRelayScan*	PowerSharpPack	Invoke-SharpLdapRelayScan	C# Port of LdapRelayScan
163	*Invoke-SharpLoginPrompt*	PowerSharpPack	Invoke-SharpLoginPrompt	This Program creates a login prompt to gather username and password of the current user. This project allows red team to phish username and password of the current user without touching lsass and having adminitrator credentials on the system.
164	*Invoke-SharpMove*	PowerSharpPack	Invoke-SharpMove	.NET Project for performing Authenticated Remote Execution.
165	*Invoke-SharpPrintNightmare*	PowerSharpPack	Invoke-SharpPrintNightmare	C# implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
166	*Invoke-SharpPrinter*	PowerSharpPack	Invoke-SharpPrinter	Discover Printers + check for vulns
167	*Invoke-SharpRDP*	PowerSharpPack	Invoke-SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution.
168	*Invoke-SharpSCCM*	PowerSharpPack	Invoke-SharpSCCM	A C# utility for interacting with SCCM
169	*Invoke-SharpSSDP*	PowerSharpPack	Invoke-SharpSSDP	SSDP Service Discovery
170	*Invoke-SharpSecDump*	PowerSharpPack	Invoke-SharpSecDump	.Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py.
171	*Invoke-SharpSniper*	PowerSharpPack	Invoke-SharpSniper	Find specific users in active directory via their username and logon IP address
172	*Invoke-SharpSploit*	PowerSharpPack	Invoke-SharpSploit	SharpSploit is a .NET post-exploitation library written in C#.
173	*Invoke-SharpSpray*	PowerSharpPack	Invoke-SharpSpray	SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.
174	*Invoke-SharpStay*	PowerSharpPack	Invoke-SharpStay	.NET project for installing Persistence
175	*Invoke-SharpUp*	PowerSharpPack	Invoke-SharpUp	SharpUp is a C# port of various PowerUp functionality.
176	*Invoke-SharpWSUS*	PowerSharpPack	Invoke-SharpWSUS	SharpWSUS is a CSharp tool for lateral movement through WSUS. There is a corresponding blog (https://labs.nettitude.com/blog/introducing-sharpwsus/) which has more detailed information about the tooling, use case and detection.
177	*Invoke-SharpWatson*	PowerSharpPack	Invoke-SharpWatson	Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities
178	*Invoke-Sharphound*	PowerSharpPack	Invoke-Sharphound	C# Data Collector for the BloodHound Project
179	*Invoke-Sharplocker*	PowerSharpPack	Invoke-Sharplocker	SharpLocker helps get current user credentials by popping a fake Windows lock screen, all output is sent to Console which works perfect for Cobalt Strike.
180	*Invoke-Sharpshares*	PowerSharpPack	Invoke-Sharpshares	Enumerate all network shares in the current domain. Also, can resolve names to IP addresses.
181	*Invoke-Sharpsploit_nomimi*	PowerSharpPack	Invoke-Sharpsploit_nomimi	SharpSploit is a .NET post-exploitation library written in C#.
182	*Invoke-Sharpview*	PowerSharpPack	Invoke-Sharpview	C# implementation of harmj0y's PowerView
183	*Invoke-Sharpweb*	PowerSharpPack	Invoke-Sharpweb	.NET 2.0 CLR project to retrieve saved browser credentials from Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge.
184	*Invoke-Snaffler*	PowerSharpPack	Invoke-Snaffler	A tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax ).
185	*Invoke-Spoolsample*	PowerSharpPack	Invoke-Spoolsample	PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.
186	*Invoke-StandIn*	PowerSharpPack	Invoke-StandIn	StandIn is a small .NET35/45 AD post-exploitation toolkit
187	*Invoke-StickyNotesExtract*	PowerSharpPack	Invoke-StickyNotesExtract	Extracts data from the Windows Sticky Notes database. Works on Windows 10 Build 1607 and higher. This project doesn't rely on any external dependencies.
188	*Invoke-Thunderfox*	PowerSharpPack	Invoke-Thunderfox	Retrieves data (contacts, emails, history, cookies and credentials) from Thunderbird and Firefox.
189	*Invoke-Tokenvator*	PowerSharpPack	Invoke-Tokenvator	A tool to elevate privilege with Windows Tokens
190	*Invoke-UrbanBishop*	PowerSharpPack	Invoke-UrbanBishop	Creates a local RW section in UrbanBishop and then maps that section as RX into a remote process. Shellcode loading made easy.
191	*Invoke-Whisker*	PowerSharpPack	Invoke-Whisker	Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding Shadow Credentials to the target account.
192	*Invoke-WireTap*	PowerSharpPack	Invoke-WireTap	.NET 4.0 Project to interact with video, audio and keyboard hardware.
193	*Invoke-winPEAS*	PowerSharpPack	Invoke-winPEAS	Check the Local Windows Privilege Escalation checklist from book.hacktricks.xyz