IR-Tools, IR工具用于红外工具.zip

### Collection of Microsoft PowerShell modules that can be used to aid with forensics of domain based attacks on an infected host. ## CodeExecution **Execute code on a target machine using Import-Module.** #### `Get-ShellContent` Extracts live input and output of any commandline process, running or dumped, encrypted or plaintext from a remote computer. #### `Get-SessionsAnomaly` Finds existence of Pass-The-Ticket and Pass-The-Hash attacks on a remote machine. ## License The IT-Tools project and all individual scripts are under the [BSD 3-Clause license] unless explicitly noted otherwise. ## Usage To install any of these modules, drop the powershell scripts into a directory and type `Import-Module PathTo\scriptName.ps1` Then run the Module from the Powershell. Refer to the comment-based help in each individual script for detailed usage information.