Mass PowerShell and WMImplant to Get Process Output

When developing WMImplant, I wanted to ensure I would have some of the same capabilities on a Device Guard (now Windows Defender Application Control) protected system as I would on a non-protected when utilizing Beacon or Meterpreter. WMImplant is a stepping stone for creating the same capabilities, but also presented

Cyber Wardog Lab: Chronicles of a Threat Hunter: Hunting for WMImplant with Sysmon and ELK - Part I (EID 1,12, 13, 17 & 18)

GitHub - jwardsmith/Active-Directory-Exploitation

Under-the-hood: WMImplant Invoking PowerShell

Cyber Wardog Lab: Chronicles of a Threat Hunter: Hunting for WMImplant with Sysmon and ELK - Part I (EID 1,12, 13, 17 & 18)

Use PowerShell and WMI to Terminate Multiple Processes - Scripting Blog [archived]

Mass PowerShell and WMImplant to Get Process Output

Building a PowerShell Process Detection Tool • The Lonely Administrator

Get Process Owner and Other Info with WMI and PowerShell - Scripting Blog [archived]

Cyber Wardog Lab: Chronicles of a Threat Hunter: Hunting for WMImplant with Sysmon and ELK - Part I (EID 1,12, 13, 17 & 18)

windows 10 - How to get number of active processes and threads running using command-line? - Super User

THE INCIDENT RESPONSE PODCAST BLOG — IMF Security

Find the owner of a process