script | RobWillis.info

Introducing Invoke-EncryptionSimulator: A PowerShell Tool for Simulating Late-Stage Ransomware Attacks

robwillisinfo — Thu, 14 Mar 2024 04:53:37 +0000

Invoke-EncryptionSimulator Invoke-EncryptionSimulator is designed to be a simple and safe way to emulate the encryption stage of a ransomware deployment to aid in development and testing of controls focusing on file system level changes rather than process related telemetry. Invoke-EncryptionSimulator is designed to be a simple and safe way to emulate the encryption stage of […]

The post Introducing Invoke-EncryptionSimulator: A PowerShell Tool for Simulating Late-Stage Ransomware Attacks first appeared on RobWillis.info.

New Tool! Invoke-RPCMap: PowerShell Script for Remote RPC Service Enumeration

robwillisinfo — Mon, 27 Jun 2022 02:13:00 +0000

Invoke-RPCMap Invoke-RPCMap can be used to enumerate local and remote RPC services/ports via the RPC Endpoint Mapper service. This information can useful during an investigation where a connection to a remote port is known, but the service is running under a generic process like svchost.exe. This script will do the following: Create a local log […]

The post New Tool! Invoke-RPCMap: PowerShell Script for Remote RPC Service Enumeration first appeared on RobWillis.info.

PowerShell Script – Set-PowerCfg

robwillisinfo — Tue, 14 Aug 2018 14:01:29 +0000

Set-PowerCfg is a simple script that can be used to easily set or check the current power scheme being applied on a Windows host, these are the same settings found in Control Panel > Power Options. This is particularly useful on laptops where CPU throttling may be an issue and you need to easily switch […]

The post PowerShell Script – Set-PowerCfg first appeared on RobWillis.info.

Powershell scripts fail when deployed via Group Policy as Startup scripts with Event ID 1055 and 1130

robwillisinfo — Mon, 02 Oct 2017 07:27:23 +0000

I recently went to deploy a new Powershell based Startup script in my test environment, and while the majority of my Windows machines happily complied, 2 of my test servers that were running Remote Desktop Services did not like the new Startup policy. The script itself was pretty straight forward – it pulled some files […]

The post Powershell scripts fail when deployed via Group Policy as Startup scripts with Event ID 1055 and 1130 first appeared on RobWillis.info.

PowerShell Script: Find the largest files and folders for any drive

robwillisinfo — Wed, 09 Jul 2014 04:04:42 +0000

Update – 04.06.2021 – I have an updated version of this script that is a little more flexible and has better output, you can find the new script here: /2021/04/powershell-script-quickly-find-the-largest-files/ This is a super easy to use and flexible PowerShell script to find out what the largest files and folders are on a single drive. […]

The post PowerShell Script: Find the largest files and folders for any drive first appeared on RobWillis.info.

Simple BGInfo AD logon script

robwillisinfo — Mon, 27 Jan 2014 16:43:50 +0000

This is my simple logon script for the popular BGInfo utility that uses a few batch scripts along with Group Policy to run at each user login. What this script does: Checks to see if bginfo.exe exist on the local machine, if not copy it from the network share to c:\bginfo\ Copy bg.jpg and default.bgi […]

The post Simple BGInfo AD logon script first appeared on RobWillis.info.

PowerShell – Simple Mass Server Shutdown/Reboot Script with Menu & Status Check (Video)

robwillisinfo — Sat, 27 Apr 2013 15:29:57 +0000

What is the purpose of this script? This is a simple script that can be used to mass shutdown or reboot any Windows hosts that are in the hosts.txt file. The script is menu driven and allows the user to view the hosts that are in the txt as well as edit it. There is […]

The post PowerShell – Simple Mass Server Shutdown/Reboot Script with Menu & Status Check (Video) first appeared on RobWillis.info.