Michael Haag
7bc7660f4f
* Discovery and Cleanup * Generate docs from job=validate_atomics_generate_docs branch=Discovery * mv discovery.bat * Fixed Discovery.bat URLs Updated Techniques with new location of discovery.bat * Generate docs from job=validate_atomics_generate_docs branch=Discovery
45 lines
1.8 KiB
Batchfile
45 lines
1.8 KiB
Batchfile
net user Administrator /domain
|
|
net Accounts
|
|
net localgroup administrators
|
|
net use
|
|
net share
|
|
net group "domain admins" /domain
|
|
net config workstation
|
|
net accounts
|
|
net accounts /domain
|
|
net view
|
|
sc query
|
|
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
|
|
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
|
|
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
|
|
reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
|
|
reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
|
|
reg query HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
|
|
reg query HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
|
|
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
|
|
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
|
|
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
|
|
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
|
|
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
|
|
wmic useraccount list
|
|
wmic useraccount get /ALL
|
|
wmic startup list brief
|
|
wmic share list
|
|
wmic service get name,displayname,pathname,startmode
|
|
wmic process list brief
|
|
wmic process get caption,executablepath,commandline
|
|
wmic qfe get description,installedOn /format:csv
|
|
arp -a
|
|
whoami
|
|
ipconfig /displaydns
|
|
route print
|
|
netsh advfirewall show allprofiles
|
|
systeminfo
|
|
qwinsta
|
|
quser
|