Hey there.
Welcome to the course, Network Discovery and Enumeration with PowerShell.
I'm Ricardo.
I'm a cybersecurity specialist with years of experience in the field,
and here,
I will show you how to use PowerShell to enumerate information about hosts,
networks, and domains in a Red Team engagement.
This course is all about leveraging PowerShell for discovery
information about your tag environment.
In here,
we'll use the Windows native features to perform all the
basic discovery enumeration like port scans,
user account enumeration, network share mapping,
and much more.
Real advanced hackers love to use PowerShell because it's a Windows
native feature that is used by regular IT admins.
By using PowerShell, hackers can blend in with regular activities on the machine,
and in this way,
the defense teams have a hard time to detect the malicious activity.
So imagine that.
Imagine that you're working on a Red Team engagement.
Your objective is to infiltrate the Globomantics network via the internet.
You've done some research and you found an external server
that is part of the Globomantics domain.
After playing around for a little bit,
you found a vulnerability the server and you were able to exploit it.
And this gives you access to the Windows server that
is part of the Globomantics domain.
Amazing, right?
That's a really good accomplishment, but that's just the beginning.
Now what you need to do is expand your attacking environment,
like get access to other machines, and escalate your privileges.
And to do that, we start with some basic environmental reconnaissance.
So, we need to do three things here.
First,
we need to enumerate the information about the host that we just compromised,
like what version of Windows is running,
which users are logged into the server, and so on.
After that, we need to enumerate the other hosts on the same network.
In this way, we can find other interesting computers to exploit.
And last, we need to enumerate information about the domain,
like who are the domain administrators,
which servers are present in the environment,
and even enumerating the service accounts in the Active Directory.
With all that information gathered,
it would be really easy to escalate privileges and move laterally.
So, let's take a quick look on what you'll be learning in this course.
First, you'll learn how to enumerate local host information,
including installed software, patches, users,
security policies, and much more.
Then, you'll learn how to use PowerShell to enumerate devices on the network,
like finding active hosts, open ports, SMB shares,
and much more.
And last,
you'll learn how to leverage PowerShell to query in Active
Directory and integrate domain formation,
like who are the domain users, computers,
service accounts, and much more.
And you'll even learn how to perform a kerberoasting attack using PowerShell.
As this course is an intermediate course,
it is expected that you have some basic knowledge on the
main security concepts and vulnerabilities.
For example,
it is expected that you know what a firewall is and how an antivirus works.
Also, it is expected that you have some basic understanding of PowerShell.
And although here we will cover the step‑by‑step of each technique,
you should at least know how PowerShell works,
and how to manipulate inputs and outputs.
And, if you've never used PowerShell before,
there is a really good course path here at Pluralsight
called Windows PowerShell Essentials.
In there,
you can find a few courses teaching you how to create a PowerShell
script and how to manipulate input and output.
If you've worked with pen tests or Red Teaming before,
you probably know several tools that do network
discovery and domain enumeration.
And although these tools do the job really well,
there are some solid advantages in using your own custom
PowerShell scripts to perform those actions.
The first main advantage is that you have full control of
what is happening in the background.
For example, if you run an Nmap script,
you don't know exactly how Nmap is doing the enumeration,
and this might trigger some alerts on the client environment.
With PowerShell,
we can tailor our scans to retrieve only the information that we need.
Also, talking about tailoring, by using PowerShell,
we can tailor the input and the output of the
script for whatever reason we want.
For example,
if we need to list all the servers with port 80 open in a CSV format,
we can easily do that with PowerShell.
And last, but most important,
using your own custom PowerShell scripts minimizes your
chances of being detected by the defense team.
PowerShell is a Windows native feature,
and IT admins also use it in their day‑to‑day jobs.
So,
it becomes really hard for the defense team to distinguish what
is malicious and what are day‑to‑day actions.
Also, antivirus solutions can easily detect out‑of‑the‑box tools.
So,
creating custom PowerShell tools minimizes our chances of
being detected by security solutions.
And for those and other reasons,
PowerShell is one of the main tools of advanced persistent threats.