Get-NetTCPConnection | Scripting and security

Network PowerShell

Relación entre puertos TCP y procesos (construir un objeto con propiedades personalizadas)

(2 votes, average: 5.00 out of 5)

Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,OwningProcess,@{n='Nombre proceso';e={Get-Process -id ($_ | Select-Object -ExpandProperty OwningProcess) | Select-Object -ExpandProperty Name}}

1	Get-NetTCPConnection \| Select-Object LocalAddress,LocalPort,OwningProcess,@{n='Nombre proceso';e={Get-Process -id ($_ \| Select-Object -ExpandProperty OwningProcess) \| Select-Object -ExpandProperty Name}}

Network PowerShell

Relación entre IP, puertos y procesos con PowerShell

(12 votes, average: 5.00 out of 5)

Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

1	Get-NetTCPConnection \| %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

PHP PowerShell

Ejecutar el cmdlet Get-NetTCPConnection de PowerShell en PHP

(3 votes, average: 5.00 out of 5)

"<?php system('powershell Get-NetTCPConnection'); ?>" | .\php.exe

1	"<?php system('powershell Get-NetTCPConnection'); ?>" \| .\php.exe

Java Network PowerShell

Ejecutar el cmdlet Get-NetTCPConnection de PowerShell en Java

(No Ratings Yet)

import java.io.IOException;
import java.util.concurrent.TimeUnit;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class ProcesoPowerShell
{
	public static void main(String[] args) throws InterruptedException
	{		
		Runtime runtime = Runtime.getRuntime();
		try
		{
			Process process = runtime.exec("powershell.exe  Get-NetTCPConnection");
			
			process.getOutputStream().close();
			String line;
			BufferedReader stdout = new BufferedReader(new InputStreamReader(process.getInputStream()));
			while ((line = stdout.readLine()) != null){
				System.out.println(line);
			}

			TimeUnit.SECONDS.sleep(10);
		}
		catch(IOException ex){
			System.err.println("Error");
			System.exit(-1);
		}
	}
}

import java.io.IOException;

import java.util.concurrent.TimeUnit;

import java.io.BufferedReader;

import java.io.IOException;

import java.io.InputStreamReader;

public class ProcesoPowerShell

{

public static void main(String[] args) throws InterruptedException

{

Runtime runtime = Runtime.getRuntime();

try

{

Process process = runtime.exec("powershell.exe Get-NetTCPConnection");

process.getOutputStream().close();

String line;

BufferedReader stdout = new BufferedReader(new InputStreamReader(process.getInputStream()));

while ((line = stdout.readLine()) != null){

System.out.println(line);

}

TimeUnit.SECONDS.sleep(10);

}

catch(IOException ex){

System.err.println("Error");

System.exit(-1);

}

Network PowerShell

Comprobar constantemente si está abierto un puerto TCP

(No Ratings Yet)

while(1)
{
    Get-NetTCPConnection | Select-Object LocalAddress,RemotePort,OwningProcess| Where-Object {$_.RemotePort -eq "443"}
    Start-Sleep -Seconds 5
    clear
}

while(1)

{

Get-NetTCPConnection | Select-Object LocalAddress,RemotePort,OwningProcess| Where-Object {$_.RemotePort -eq "443"}

Start-Sleep -Seconds 5

clear

}

PowerShell

9. Gestión de la red en PowerShell (nivel intermedio)

(4 votes, average: 4.00 out of 5)

Capa física Adaptadores de red Información sobre los adaptadores de red Información avanzada sobre los adaptadores de red Habilitar un […]

Network PowerShell

Listar puertos abiertos en Windows 10 con PowerShell

(No Ratings Yet)

Get-NetUDPEndpoint | Select-Object LocalPort
Get-NetTCPConnection | Select-Object LocalPort

1 2	Get-NetUDPEndpoint \| Select-Object LocalPort Get-NetTCPConnection \| Select-Object LocalPort

Network PowerShell

Analizar información de red (protocolo TCP)

(2 votes, average: 3.50 out of 5)

#Relación entre IP, puertos y procesos
Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP
((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias
(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

#Relación entre IP, puertos y procesos

Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP

((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias

(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

Network PowerShell Processes Services Threads

Mostrar los hilos que se están ejecutando en relación con los servicios, los procesos y los puertos abiertos TCP

(1 votes, average: 5.00 out of 5)

#Mostrar los hilos que se están ejecutando en relación con los servicios, los procesos y los puertos abiertos TCP
$i=0
(Get-WmiObject -Class Win32_Thread) | %{
$i++
Write-Host $i,$_.Handle,$_.ProcessHandle,(Get-WmiObject -Class Win32_Service | Where-Object State -EQ ‘Running’ | Where-Object ProcessId -EQ $_.ProcessHandle),(Get-Process -Id $_.ProcessHandle).ProcessName
Write-Host (Get-Process -Id $_.ProcessHandle).ProcessName,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessHandle | select LocalPort,RemoteAddress,RemotePort,OwningProcess)
}

#Mostrar los hilos que se están ejecutando en relación con los servicios, los procesos y los puertos abiertos TCP

$i=0

(Get-WmiObject -Class Win32_Thread) | %{

$i++

Write-Host $i,$_.Handle,$_.ProcessHandle,(Get-WmiObject -Class Win32_Service | Where-Object State -EQ ‘Running’ | Where-Object ProcessId -EQ $_.ProcessHandle),(Get-Process -Id $_.ProcessHandle).ProcessName

Write-Host (Get-Process -Id $_.ProcessHandle).ProcessName,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessHandle | select LocalPort,RemoteAddress,RemotePort,OwningProcess)

}

Network PowerShell Processes Services

Mostrar información avanzada de los procesos que se están ejecutando en relación con los servicios y los puertos abiertos TCP (Get-NetTCPConnection)

(No Ratings Yet)

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos TCP
(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{
#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ  $_.ProcessId | select name, Path, ExecutablePath, CommandLine)
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)
Write-Host "##################################################"
}

#Mostrar información avanzada de los procesos (Path, ExecutablePath, CommandLine) que se están ejecutando en relación con los servicios y los puertos abiertos TCP

(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{

#Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId | Select-Object name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ $_.ProcessId | select name, Path, ExecutablePath, CommandLine)

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)

Write-Host "##################################################"

}

Network PowerShell Processes Services

Mostrar los procesos que se están ejecutando en relación con los servicios y los puertos abiertos TCP

(No Ratings Yet)

#Mostrar los procesos que se están ejecutando en relación con los servicios y los puertos abiertos TCP
(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{
Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)
}

#Mostrar los procesos que se están ejecutando en relación con los servicios y los puertos abiertos TCP

(Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{

Write-Host $_.Name,$_.ProcessId,$_.State,(Get-Process -Id $_.ProcessId).Name,(Get-NetTCPConnection | where OwningProcess -EQ $_.ProcessId | select LocalPort,RemoteAddress,RemotePort,OwningProcess)

}

Network PowerShell

Relación entre puertos TCP, procesos y lista de puertos de la IANA (junto con una breve descripción de cada puerto)

(No Ratings Yet)

#Descargar y guardar el listado de puertos
Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile e:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA
$portscsv=Import-Csv e:\service-names-port-numbers.csv
$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol','Description' | Where-Object 'Transport Protocol' -EQ tcp
Get-NetTCPConnection | %{Write-Host $_.Localaddress, ($listado | Select-Object 'Service Name','Port Number','Description' | Where-Object 'Port Number' -EQ $_.RemotePort), $_.Remoteaddress} | Format-Custom

#Descargar y guardar el listado de puertos

Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile e:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA

$portscsv=Import-Csv e:\service-names-port-numbers.csv

$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol','Description' | Where-Object 'Transport Protocol' -EQ tcp

Get-NetTCPConnection | %{Write-Host $_.Localaddress, ($listado | Select-Object 'Service Name','Port Number','Description' | Where-Object 'Port Number' -EQ $_.RemotePort), $_.Remoteaddress} | Format-Custom

Network PowerShell

Relación entre puertos TCP, procesos y lista de puertos de la IANA

(No Ratings Yet)

#Descargar y guardar el listado de puertos
Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile e:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA
$portscsv=Import-Csv e:\service-names-port-numbers.csv
$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol' | Where-Object 'Transport Protocol' -EQ tcp
Get-NetTCPConnection | %{Write-Host $_.Localaddress, ($listado | Select-Object 'Service Name','Port Number' | Where-Object 'Port Number' -EQ $_.RemotePort), $_.Remoteaddress} | Format-Custom

#Descargar y guardar el listado de puertos

Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile e:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA

$portscsv=Import-Csv e:\service-names-port-numbers.csv

$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol' | Where-Object 'Transport Protocol' -EQ tcp

Get-NetTCPConnection | %{Write-Host $_.Localaddress, ($listado | Select-Object 'Service Name','Port Number' | Where-Object 'Port Number' -EQ $_.RemotePort), $_.Remoteaddress} | Format-Custom

Network PowerShell

Gets information about current TCP connection statistics

(No Ratings Yet)

Get-NetTCPConnection

1	Get-NetTCPConnection

PowerShell

9. Gestión de la red en PowerShell para administradores de sistemas (nivel básico)

(1 votes, average: 5.00 out of 5)

Relación de las capas de red con cmdlets de PowerShell. Capa física Relación con el medio físico, información sobre las tarjetas […]

PowerShell Security

Windows Post Exploitation Cmdlets Execution (PowerShell)

(5 votes, average: 5.00 out of 5)

Presence This section focuses on information gathering about the victim host and the network that it’s attached to. System

#Shows all current environmental variables
$env:ALLUSERSPROFILE
$env:APPDATA
$env:CommonProgramFiles
${env:CommonProgramFiles(x86)}
$env:CommonProgramW6432
$env:COMPUTERNAME
$env:ComSpec
$env:FP_NO_HOST_CHECK
$env:HOMEDRIVE
$env:HOMEPATH
$env:LOCALAPPDATA
$env:LOGONSERVER
$env:NUMBER_OF_PROCESSORS
$env:OS
$env:Path
$env:PATHEXT
$env:PROCESSOR_ARCHITECTURE
$env:PROCESSOR_IDENTIFIER
$env:PROCESSOR_LEVEL
$env:PROCESSOR_REVISION
$env:ProgramData
$env:ProgramFiles
${env:ProgramFiles(x86)}
$env:ProgramW6432
$env:PSModulePath
$env:PUBLIC
$env:SESSIONNAME
$env:SystemRoot
$env:TEMP
$env:TMP
$env:USERDOMAIN
$env:USERDOMAIN_ROAMINGPROFILE
$env:USERNAME
$env:USERPROFILE
$env:SystemDrive
$env:windir

#Shows all current environmental variables (macOS)
$env:_ 
$env:LOGNAME
$env:SHLVL
$env:TERM_SESSION_ID
$env:PATHEXT
$env:__CF_USER_TEXT_ENCODING
$env:PATH
$env:SSH_AUTH_SOCK
$env:TMPDIR
$env:Apple_PubSub_Socket_Render
$env:PSMODULEPATH
$env:TERM
$env:USER
$env:HOME
$env:PWD
$env:TERM_PROGRAM
$env:XPC_FLAGS
$env:LC_CTYPE
$env:SHELL
$env:TERM_PROGRAM_VERSION
$env:XPC_SERVICE_NAME

#Information about disk
Get-Disk

#Retrieving Process Information
Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process
(Get-Process chrome | Select-Object Threads).Threads
Get-Process | select -expand Threads

#Last Boot Uptime
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system
Get-Process -Module

#Events and event logs on the local and remote
Get-EventLog -LogName System -EntryType Error, Warning
Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

#Shows all current environmental variables

$env:ALLUSERSPROFILE

$env:APPDATA

$env:CommonProgramFiles

${env:CommonProgramFiles(x86)}

$env:CommonProgramW6432

$env:COMPUTERNAME

$env:ComSpec

$env:FP_NO_HOST_CHECK

$env:HOMEDRIVE

$env:HOMEPATH

$env:LOCALAPPDATA

$env:LOGONSERVER

$env:NUMBER_OF_PROCESSORS

$env:OS

$env:Path

$env:PATHEXT

$env:PROCESSOR_ARCHITECTURE

$env:PROCESSOR_IDENTIFIER

$env:PROCESSOR_LEVEL

$env:PROCESSOR_REVISION

$env:ProgramData

$env:ProgramFiles

${env:ProgramFiles(x86)}

$env:ProgramW6432

$env:PSModulePath

$env:PUBLIC

$env:SESSIONNAME

$env:SystemRoot

$env:TEMP

$env:TMP

$env:USERDOMAIN

$env:USERDOMAIN_ROAMINGPROFILE

$env:USERNAME

$env:USERPROFILE

$env:SystemDrive

$env:windir

#Shows all current environmental variables (macOS)

$env:_

$env:LOGNAME

$env:SHLVL

$env:TERM_SESSION_ID

$env:PATHEXT

$env:__CF_USER_TEXT_ENCODING

$env:PATH

$env:SSH_AUTH_SOCK

$env:TMPDIR

$env:Apple_PubSub_Socket_Render

$env:PSMODULEPATH

$env:TERM

$env:USER

$env:HOME

$env:PWD

$env:TERM_PROGRAM

$env:XPC_FLAGS

$env:LC_CTYPE

$env:SHELL

$env:TERM_PROGRAM_VERSION

$env:XPC_SERVICE_NAME

#Information about disk

Get-Disk

#Retrieving Process Information

Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Lists running threads for a specified process

(Get-Process chrome | Select-Object Threads).Threads

Get-Process | select -expand Threads

#Last Boot Uptime

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

#Lists the current drivers on the system

Get-Process -Module

#Events and event logs on the local and remote

Get-EventLog -LogName System -EntryType Error, Warning

Get-EventLog -LogName System -EntryType Error, Warning -ComputerName $computer

[…]

Network PowerShell

Relación entre puertos TCP y procesos

(No Ratings Yet)

Get-NetTCPConnection | %{Write-Host (Get-Process -id $_.OwningProcess).Name,$_.RemoteAddress,$_.RemotePort}

1	Get-NetTCPConnection \| %{Write-Host (Get-Process -id $_.OwningProcess).Name,$_.RemoteAddress,$_.RemotePort}

Network PowerShell

Relación entre puertos abiertos TCP y lista de puertos de la IANA

(No Ratings Yet)

#Descargar y guardar el listado de puertos
Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile d:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA
$portscsv=Import-Csv d:\service-names-port-numbers.csv
$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol' | Where-Object 'Transport Protocol' -EQ tcp
Get-NetTCPConnection | Select-Object Localaddress,Remoteport,Remoteaddress | %{$_.Localaddress; $listado | Select-Object 'Service Name','Port Number' | Where-Object 'Port Number' -EQ $_.RemotePort;$_.Remoteaddress} | Format-Custom

#Descargar y guardar el listado de puertos

Invoke-WebRequest 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv' -OutFile d:\service-names-port-numbers.csv

#Relación entre puertos abiertos TCP y lista de puertos la IANA

$portscsv=Import-Csv d:\service-names-port-numbers.csv

$listado=$portscsv | Select-Object 'Service Name','Port Number','Transport Protocol' | Where-Object 'Transport Protocol' -EQ tcp

Get-NetTCPConnection | Select-Object Localaddress,Remoteport,Remoteaddress | %{$_.Localaddress; $listado | Select-Object 'Service Name','Port Number' | Where-Object 'Port Number' -EQ $_.RemotePort;$_.Remoteaddress} | Format-Custom

PHP PowerShell Security

Seguridad informática con PowerShell

(2 votes, average: 5.00 out of 5)

Introducción Confidencialidad

#Habilitar BitLocker
Enable-BitLocker -MountPoint "f:" -RecoveryPasswordProtector -UsedSpaceOnly -Verbose

#Deshabilitar BitLocker
Disable-BitLocker -MountPoint "f:"

#Habilitar BitLocker

Enable-BitLocker -MountPoint "f:" -RecoveryPasswordProtector -UsedSpaceOnly -Verbose

#Deshabilitar BitLocker

Disable-BitLocker -MountPoint "f:"

Integridad

#Calcular hash para un archivo
Get-FileHash D:\power\fichero.txt -Algorithm MD5
Get-FileHash D:\power\fichero.txt -Algorithm SHA1
Get-FileHash D:\power\fichero.txt -Algorithm SHA256
Get-FileHash D:\power\fichero.txt -Algorithm SHA384
Get-FileHash D:\power\fichero.txt -Algorithm SHA512
Get-FileHash D:\power\fichero.txt -Algorithm RIPEMD160

#Calcular hash para un archivo

Get-FileHash D:\power\fichero.txt -Algorithm MD5

Get-FileHash D:\power\fichero.txt -Algorithm SHA1

Get-FileHash D:\power\fichero.txt -Algorithm SHA256

Get-FileHash D:\power\fichero.txt -Algorithm SHA384

Get-FileHash D:\power\fichero.txt -Algorithm SHA512

Get-FileHash D:\power\fichero.txt -Algorithm RIPEMD160

Seguridad física Analizar el hardware de los equipos de la empresa

$credenciales=Get-Credential
1..254 | %{
    (Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID
    (Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer
    (Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version
    (Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID
    Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales
    Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales
    Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales
    Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales
}

$credenciales=Get-Credential

1..254 | %{

(Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID

(Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer

(Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version

(Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID

Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales

Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales

}

Ver dispositivos conectados […]

Forensic analysis Network PowerShell

Adquisición de datos volátiles

(1 votes, average: 5.00 out of 5)

#Información sobre procesos
Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Información sobre hilos
(Get-Process chrome | Select-Object Threads).Threads
Get-Process | select -expand Threads

#Información sobre conexiones
#https://www.jesusninoc.com/2015/11/13/cmdlets-for-tcpip-model-layers/
Get-NetAdapterHardwareInfo
Get-NetAdapter -Physical
Get-NetNeighbor
Get-NetAdapterStatistics
Get-NetAdapter | Select-Object Name,MacAddress
Get-NetAdapter | Select-Object Name,MacAddress
Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress
Get-NetAdapter | Select-Object Name,MacAddress
Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress
((Get-NetAdapterBinding).DisplayName) -match 'Protocolo de Internet'
(Get-NetIPInterface) | Select-Object InterfaceAlias,AddressFamily
Get-NetIPv4Protocol
Get-NetIPv6Protocol
Get-NetRoute
Get-NetNat
Get-NetNatExternalAddress
Get-NetNatGlobal
Get-NetNatSession
Get-NetNatStaticMapping
Get-NetNatTransitionConfiguration
Get-NetNatTransitionMonitoring
Get-NetFirewallAddressFilter
Get-NetFirewallApplicationFilter
Get-NetFirewallInterfaceFilter
Get-NetFirewallInterfaceTypeFilter
Get-NetFirewallPortFilter
Get-NetFirewallProfile
Get-NetFirewallRule
Get-NetFirewallSecurityFilter
Get-NetFirewallServiceFilter
Get-NetFirewallSetting
Get-NetTCPSetting
Get-NetTCPConnection
Get-NetTCPConnection | Select-Object LocalPort,Remoteport
Get-NetUDPSetting
Get-NetUDPEndpoint
(Get-NetUDPEndpoint).LocalPort
Get-DnsClient
Get-DnsClientCache
Get-DnsClientGlobalSetting
Get-DnsClientNrptGlobal
Get-DnsClientNrptPolicy
Get-DnsClientNrptRule
Get-DnsClientServerAddress

#Fecha y hora del sistema
Get-Date

#Última hora de arranque del sistema
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime
Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}

#DLL
Get-Process | select -expand MainModule
Get-Process | select -expand Modules

#Información sobre procesos

Get-Process | Select-Object Name,Path,Company,CPU,Product,TotalProcessorTime,StartTime

#Información sobre hilos

(Get-Process chrome | Select-Object Threads).Threads

Get-Process | select -expand Threads

#Información sobre conexiones

#https://www.jesusninoc.com/2015/11/13/cmdlets-for-tcpip-model-layers/

Get-NetAdapterHardwareInfo

Get-NetAdapter -Physical

Get-NetNeighbor

Get-NetAdapterStatistics

Get-NetAdapter | Select-Object Name,MacAddress

Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress

Get-NetAdapter | Select-Object Name,MacAddress

Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Select-Object Description,MACAddress

((Get-NetAdapterBinding).DisplayName) -match 'Protocolo de Internet'

(Get-NetIPInterface) | Select-Object InterfaceAlias,AddressFamily

Get-NetIPv4Protocol

Get-NetIPv6Protocol

Get-NetRoute

Get-NetNat

Get-NetNatExternalAddress

Get-NetNatGlobal

Get-NetNatSession

Get-NetNatStaticMapping

Get-NetNatTransitionConfiguration

Get-NetNatTransitionMonitoring

Get-NetFirewallAddressFilter

Get-NetFirewallApplicationFilter

Get-NetFirewallInterfaceFilter

Get-NetFirewallInterfaceTypeFilter

Get-NetFirewallPortFilter

Get-NetFirewallProfile

Get-NetFirewallRule

Get-NetFirewallSecurityFilter

Get-NetFirewallServiceFilter

Get-NetFirewallSetting

Get-NetTCPSetting

Get-NetTCPConnection

Get-NetTCPConnection | Select-Object LocalPort,Remoteport

Get-NetUDPSetting

Get-NetUDPEndpoint

(Get-NetUDPEndpoint).LocalPort

Get-DnsClient

Get-DnsClientCache

Get-DnsClientGlobalSetting

Get-DnsClientNrptGlobal

Get-DnsClientNrptPolicy

Get-DnsClientNrptRule

Get-DnsClientServerAddress

#Fecha y hora del sistema

Get-Date

#Última hora de arranque del sistema

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}

#DLL

Get-Process | select -expand MainModule

Get-Process | select -expand Modules

Older Posts