Procedure examples

PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.

PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.

PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.

PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.

PowerSploit modules are written in and executed via PowerShell.

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.

PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.

PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.

PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.

PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.

PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.

PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.

PowerSploit reflectively loads a Windows PE file into a process.