Last updated 4 months ago
Event ID 19: Successful installation of updates.
Event ID 17: Updates downloaded but not yet installed.
Get-Content "$env:UserProfile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Select-Object TimeCreated, Message | Export-Csv -Path "PowerShell_Operational_Logs.csv" -NoTypeInformation -Encoding UTF8
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -match "<Suspicious IP>" }
Get-NetTCPConnection | Where-Object { $_.RemotePort -eq 443 } | Sort-Object State, RemoteAddress
Get-WinEvent -LogName Security | Where-Object { $_.Message -match "miner" } | Select-Object TimeCreated, Message
Get-ScheduledTask | Where-Object { $_.TaskName -match "crypto|xmrig|miner" }
Get-Process | Select-Object Name, Id, Path, CPU, StartTime | Sort-Object CPU -Descending
Get-Process | Where-Object { $_.Name -match "xmrig" }
Get-WinEvent -LogName "Microsoft-Windows-WindowsUpdateClient/Operational" | Where-Object { $_.Id -eq 19 } | Select-Object TimeCreated, Message
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object DisplayName, DisplayVersion, InstallDate