# Red
## Set IP address using #netsh. Needs elevation
### Fetch all interface names
```MS-DOS
netsh interface ip show interfaces
```
### Set a IP address & gateway
```MS-DOS
netsh interface ip add address name="Wi-Fi" addr=192.168.100.200 mask=255.255.255.0 gateway=192.168.100.1 gwmetric=2000
```

## Set IP address using PowerShell
### Add an IPv4 address
https://www.jesusninoc.com/2014/02/10/add-ipv4-address/

### Agregar más de una dirección IP a una conexión de red con PowerShell
https://www.jesusninoc.com/2017/02/28/agregar-mas-de-una-direccion-ip-a-una-conexion-de-red-con-powershell/

# Monitorización

## 10. Gestión del rendimiento en PowerShell
https://www.jesusninoc.com/2017/07/10/10-gestion-del-rendimiento-en-powershell/

- Monitorización
- Rendimiento
- Registros del sistema
- Reparación
- Copias de seguridad
- Restauración

## Monitorizar procesos
### 7. Gestión de procesos en PowerShell
https://www.jesusninoc.com/2017/07/07/7-gestion-de-procesos-en-powershell/

## Monitorizar servicios
### Analizar servicios con PowerShell
https://www.jesusninoc.com/2016/11/10/analizar-servicios-con-powershell/

## Monitorizar red
### Enabling DNS Logging for Windows Server 2012
http://support.moonpoint.com/network/dns/windows/logging/srvr2012.php

### Mostrar información sobre las reglas del Firewall de Windows con PowerShell
```PowerShell
$f = New-object -comObject HNetCfg.FwPolicy2
$f.Rules | Select-Object name,applicationname,localports,remoteports | Out-GridView
```

### Display list of blocked ports
```PowerShell
$f = New-object -comObject HNetCfg.FwPolicy2
$f.rules |  where {$_.action -eq "0"} | select name,applicationname,localports
```

## Herramienta de monitorización de procesos en Windows
process-forest is a tool that processes Microsoft Windows EVTX event logs that contain process accounting events and reconstructs the historical process heirarchies. That is, it displays the parent-child relationships among programs. When using this tool during an incident response engagement, identifying a reverse shell process quickly leads to the processes launched by the operator, and insight into how it may be maintaining persistence.
https://github.com/williballenthin/process-forest

# WMIC

## Listar actualizaciones y almacenar en un fichero html
```MS-DOS
wmic qfe list full /format:htable > hotfixes.htm
```

## Examples of WMIC commands for Windows .NET SERVER Family 
https://www.cs.cmu.edu/~tgp/scsadmins/winadmin/WMIC_Queries.txt

## Enable RDP remotely via #wmic on #Windows 2008 and above: 
```MS-DOS
wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TerminalServiceSetting WHERE (__CLASS !="") CALL SetAllowTSConnections 1
```

## WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets
https://subt0x11.blogspot.com.es/2018/04/wmicexe-whitelisting-bypass-hacking.html

## Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
https://github.com/api0cradle/LOLBAS

## GTFOBins
GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.
https://gtfobins.github.io/
