Outline - PSBlackOps/GrrCON-Workshop GitHub Wiki

The Spirit of 'The Class'

Overall, the class should not be death by PowerPoint. One of the best ways to learn new concepts is by doing and playing. The course, therefore, should be structured around "Try-it Times" and getting the classroom involved.

Core concepts should be on slides, but expansion of those concepts will be done in code taken from the course repository on GitHub.

Core Concepts

  1. Launching PowerShell
  2. Getting help/exploring Commands
  3. Everything's an object
  4. Intro to Editors
  5. Basic Syntax
    • Variables
    • Comparison Operators
    • Arithmetic Operators
    • Matching Operators
    • Loops
    • Splatting
  6. Hashtables, Arrays, and Custom Objects
  7. Remoting
  8. WMI
  9. Registry
  10. .NET
  11. Writing Scripts
    1. Functions vs. Advanced Functions
    2. Comment-based help
    3. Writing code for sharing
  12. Testing Scripts & Test-driven Development
  13. Project
    1. Persistence with PowerShell
      • Registry
      • File
      • WMI
      • Scheduled Task
    2. I dunno, forensication?

Exercises

  1. Launching PowerShell
    • Create a profile
    • Get/Set Execution Policy
  2. Updating Help (locally, possibly no internet)
  3. Get-ChildItem
    • verb-noun
    • positional parameters
    • filtering
  4. Intro to Editors - Interactive Development
    • PowerShell ISE
    • VS Code
  5. Basic syntax:
    • Assign variables
    • Compare variables
      • -eq
      • -like
      • -match
      • -contains
      • -gt
      • -ge
      • -lt
      • -le
      • -is
      • ...you get the picture
  6. Hashtables, Arrays, and Custom Objects
    • Hashtables
      • Create a hashtable
      • Enumerate hashtable
      • Add hashtable item
    • Arrays
      • Create an array
      • Add array items

Class Projects

  1. Write a Persistence mechanism multiple ways
  2. Get information about a remote host
  • Use remoting
  • Use WMI
  • Registry
  • Get some event logs or other forensic info