So as you can see,
using the different types of PowerShell can obviously
dictate the types of results we get back,
the format we get back, and of course, if things are available.
So what we need to do here, to help us,
is to add supporting tools into the equation.
So what supporting tools do we have?
Well, first off, we have downloadable scripts.
We can go into the internet, type in some text for a search,
you know, maybe you want to search for PowerShell triage script or whatever,
and you'll find a whole bunch of different scripts available.
So you can download other things that other people have done.
We could also add, which is one of my favorites,
is to add the Microsoft Sysinternals tools into the equation as well.
So these are free, we can download them,
and then we can execute them as part of our regular PowerShell.
We can also use open‑source applications that might be
available that are specifically designed for this.
And then we can go and drop some money and buy a vendor application if needed.
So, four different types of things to support us retrieving triage information.
So let's talk about downloadable scripts.
Many of these are available in most free code repositories.
So obviously a big one here would be GitHub.
You can do a search in GitHub and find all kinds of different
PowerShell scripts that people have written.
They are written, often, with real‑world experience,
but what I would say here is it's real‑world experience often
targeted to the specific experience that the individual had when
they wrote the PowerShell script.
So you may need to look at the script a little bit,
it may need to be adjusted, or it may just work the way you want it to,
but you should always review what's been written.
Some of these are maintained, many of them are not.
These do fill the gaps in the basic PowerShell scripting process.
Especially if you're not 100% familiar with how to script certain things,
you can find it in a PowerShell script that somebody else has written.
It provides enhanced abilities for output.
So this is one area where you can definitely get benefit.
Even if you're writing your own scripts,
you may want to get a script that somebody else has
written or a module that somebody else has written that
provides better output capabilities.
And as I mentioned before, you'll need to review the scripts before execution.
So what about the Microsoft Sysinternals?
Well, these ones are great.
They're freely available and maintained by Microsoft.
They are designed for support and troubleshooting.
So I want you to think about that.
If a tool is designed for support and deep trouble shooting,
then it's going to somehow already have access to the
information that we might need.
They are not specifically forensic or triage applications, though.
So don't think it's going to do everything for you.
You'll obviously have to grab the data and then understand it in a certain way.
It'll provide enhanced information inspection and gathering and obviously can
perform tasks that you can't necessarily do within PowerShell.
That's the power that comes by using a support or troubleshooting,
for example,
command‑line tool that was written to do a specific job that
just doesn't have an interface in PowerShell.
So definitely one thing to add to your list of support tools.
If we go with an open‑source application,
I mean there are many, many of these available,
you can use the web browser to search for open‑source Windows triage
application and you'll see a whole host of them.
Lots of them are not all maintained.
So you might need to be aware of that.
They may just be sitting there and may not have been updated for years.
They contain most of the features that would be required to triage,
and often they do add case management.
So if you are really wanting to do a proper triage and investigation,
then that involves creating a case, importing the data,
and then generating all the reports and analytics,
etc.
So definitely an option to go down.
Now of course, if you decide to drop some money and buy a vendor application,
then you're going to get something that was specifically
designed for triage and forensics.
It was built to support much more than just information gathering,
will provide case management for definite,
and then provides full investigation, triage,
and forensic workflow.
So a vendor application will give you much more tooling to do certain things,
even though you may still need to execute PowerShell commands.
So let's talk about the supporting tools that I would kind of focus on.
Well, the first one for me is going to be Microsoft Sysinternals.
This should be in everybody's toolbox.
It should be one that you add.
It's very simple.
There's multiple ways of executing.
Some of them are command line, some of them are GUI interface,
but they will give you the information that you want.
The other one would be a set of information available
in PowerShell called PowerForensics,
which is definitely a tool that you can look at as well.
But I think we'll focus on things like Microsoft Internals.