Get-log4j-Windows.ps1

Get-log4j-Windows.ps1 Identify all log4j components across all windows servers, entire domain, can be multi domain. CVE-2021-44228 Will scale to 1,000+ windows servers, 250+ servers at a time. 1k servers took about 1 1/2 hours. Apache log4j CVE-2021-44228 Single Server Version: Single Server...

cve-2020-1350

This is a powershell script that'll grab all the AD servers for the domain your computer is on. It'll then set the CVE 2020-1350 DNS workaround on those servers and restart DNS. NOTE!! it will restart DNS so you might need a maintenance window to run it. This workaround does not mean that you can...

CVE-2013-3900_Remediation_PowerShell

CVE-2013-3900RemediationPowerShell Script to make changes on registry to fix CVE-2013-3900. It comes with an option to undo in case it breaks something on your environment. Steps Download the script, run it with Admin Privileges, reboot the machine...

CVE-2019-0708-Check-Device-Patch-Status

CVE-2019-0708-Vulnerability-Scanner Powershell script to run and determine if a specific device has been patched for CVE-2019-0708. This checks to see if the termdd.sys file has been updated appropriate and is at a version level at or greater than the versions released in the 5/14/19 patches. All...

Set-ZerologonMitigation

Set-ZerologonMitigation Protect your domain controllers against Zerologon CVE-2020-1472. Usage After installing the August 2020 security update or a later cumulative version, just run the script on each of your domain controllers. .\Set-ZerologonMitigation.ps1 For help, run Get-Help: Get-Help...

CVE-2020-16898_Check

CVE-2020-16898Check Minor powershell script that checks for vulnerable interfaces...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection A high-performance PowerShell 7+ script for scanning IIS logs to detect signs of exploitation related to ToolShell , specifically targeting the zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint. This...

VMwareCloak

VMwareCloak A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

Sherlock

Deprecated. Have a look at Watson instead. Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. Currently looks for: MS10-015 : User Mode to Ring KiTrap0D MS10-092 : Task Scheduler MS13-053 : NTUserMessageCall Win32k Kernel Pool...

Invoke-ATTACKAPI

Invoke-ATTACKAPI DEPRECATED WE RECOMMEND TO USE: https://github.com/Cyb3rWard0g/ATTACK-Python-Client A PowerShell script to interact with the MITRE ATT&CK Framework via its own API in order to gather information about techniques, tactics, groups, software and references provided by the MITRE ATT&...

Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...

CVE-2021-34527-PrintNightmare-Workaround

CVE-2021-34527-PrintNightmare-Workaround This simple PowerShell script is in response to the "PrintNightmare" vulnerability. This was designed to give a end user the ability to stop and disable the "Print Spooler" service on their computer while awaiting a fix from Microsoft. When the service is...

CVE-2021-44228_scanner

CVE-2021-44228scanner Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of JndiLookup.class. Depending on the platform that you are investigating, the PowerShell or the Python3 script may make more...

CVE-2020-1350

Warning This repository has been archived and is no longer actively maintained. CVE-2020-1350 This Powershell Script is checking if your server is vulnerable for the CVE-2020-1350 Remote Code Execution flaw in the Windows DNS Service. Supported OS for this workaround script Windows Server 2012...

HAFNIUM-IOC

HAFNIUM-IOC Hafnium-IOC is a simple PowerShell script that runs on Exchange servers to identify indicators of compromises IOCs from the Hafnium activity release by Mircosoft on 2021-03-02 https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/. The script may be...

Fix-Log4j-PowershellScript

Fix-Log4j-PowershellScript CVE-2021-44228 search and remove JNDI Lookup Class from log4j.jar files on the system with Powershell Windows make sure you use the latest script release! Release version 1.6.2 and above Killmode for Java processes implemented. $killMode defaults to $false if not change...

CVE-2024-38063-Remediation

CVE-2024-38063-Remediation Audit script Download script using powershell one-liner $downloadURI = 'https://raw.githubusercontent.com/dweger-scripts/CVE-2024-38063-Remediation/main/Audit-PatchInstalled-ipv6Vuln.ps1'; $script = 'C:\temp\Audit-PatchInstalled-ipv6Vuln.ps1'; Invoke-WebRequest -URI...

Search-log4Jvuln-AppScanSTD

Search log4J vuln using AppScan Standard and a list of websites This Powershell script run AppScan Standard scans against a list of web sites URLs.txt checking just for Log4J CVE-2021-44228 vulnerability. Structure of project: After run the script, it will read each line in URLs.txt and start...

KSK-ITDK-CVE-2026-21509-Mitigation

CVE-2026-21509-Mitigation Powershell script with Detection and Remediation for CVE-2026-21509...

quick-fix-cve-2024-38063

quick-fix-cve-2024-38063 quick powershell script to fix cve-2024-38063 Donation if you want to support my works, you can donate me at the following monero address: 4B9WQivaHfd3miDfPKEfCianocGpBx9d8FXycz2vmNW3aBDVKHgkBd9Gmapt4RBVEpTwnehujsiUBBehUiLvnEHs7VFstCC Or using PayPal:...