jsecurity101

$EtwInspectorURL = "https://github.com/jsecurity101/ETWInspector/releases/download/1.0/EtwInspector.exe"
$JonMonURL = "https://github.com/jsecurity101/JonMon/releases/download/Beta-0.01/JonMon.zip"

$EtwInspecter = "EtwInspector.exe"
$JonMonZIP = "JonMon.zip"

# Download the file using Invoke-WebRequest
Write-Output "Downloading EtwINspector..."
Invoke-WebRequest -Uri $EtwInspectorURL -OutFile $EtwInspecter
Write-Output "EtwInspector Downloaded"

jsecurity101

PS > Get-FwFilter -Key 8560068a-cb5a-4521-84cf-e1c0072dc359 | Format-FwFilter
Name       : Custom Outbound Filter
Action Type: Block
Key        : 8560068a-cb5a-4521-84cf-e1c0072dc359
Id         : 68421
Description:
Layer      : FWPM_LAYER_ALE_AUTH_CONNECT_V4
Sub Layer  : FWPM_SUBLAYER_UNIVERSAL
Flags      : Persistent, Indexed
Weight     : 274877906944

jsecurity101

PS > Get-FwFilter -Id 68421 | Format-FwFilter
Name       : Custom Outbound Filter
Action Type: Block
Key        : 8560068a-cb5a-4521-84cf-e1c0072dc359
Id         : 68421
Description:
Layer      : FWPM_LAYER_ALE_AUTH_CONNECT_V4
Sub Layer  : FWPM_SUBLAYER_UNIVERSAL
Flags      : Persistent, Indexed
Weight     : 274877906944

jsecurity101

$LoadedDrivers = Get-CimInstance -ClassName Win32_SystemDriver 

$LoadedDrivers | % {
if ($_.PathName -ne $null) {
        # Check if the path starts with \??\ and adjust the relative path
        if ($_.PathName.StartsWith("\??\")) {
            $RelativePath = $_.PathName.Remove(0,4)
        } else {
            $RelativePath = $_.PathName
        }

jsecurity101

List was compiled by Jonathan Johnson (@jsecurity101) and Carlos Perez (@Carlos_Perez)

Queries are not complete and are meant to be a reference. If you are using them for hunting use a contains within the query language.

• Kerberoasting
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
  • (&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(msds-supportedencryptiontypes:1.2.840.113556.1.4.804:=24))
• Attributes with passwords
• (userpassword=*)

jsecurity101

enum MACRO_STATUS : __int64
{
  STATUS_WAIT_0 = 0x0,
  STATUS_SEVERITY_INFORMATIONAL = 0x1,
  STATUS_SEVERITY_WARNING = 0x2,
  STATUS_SEVERITY_ERROR = 0x3,
  STATUS_SUCCESS = 0x0,
  STATUS_WAIT_1 = 0x1,
  STATUS_WAIT_2 = 0x2,
  STATUS_WAIT_3 = 0x3,

jsecurity101

#Author: Jonathan Johnson (@jsecurity101)

function New-DriverConfig {

<#
	.EXAMPLE
    New-DriverConfig -Block
    Creates driver block config in the current directory

    .EXAMPLE

jsecurity101

jsecurity101

jsecurity101

if (-not ('TokenInformation.ProcessNativeMethods' -as [type])){
    $TypeDef = @'
 using System;
 using System.Runtime.InteropServices;
 namespace TokenInformation {
     [Flags]
     public enum ProcessAccess {
         All = 0x001FFFFF,
         Terminate = 0x00000001,
         CreateThread = 0x00000002,