Outline - PSBlackOps/GrrCON-Workshop GitHub Wiki
The Spirit of 'The Class'
Overall, the class should not be death by PowerPoint. One of the best ways to learn new concepts is by doing and playing. The course, therefore, should be structured around "Try-it Times" and getting the classroom involved.
Core concepts should be on slides, but expansion of those concepts will be done in code taken from the course repository on GitHub.
Core Concepts
- Launching PowerShell
- Getting help/exploring Commands
- Everything's an object
- Intro to Editors
- Basic Syntax
- Variables
- Comparison Operators
- Arithmetic Operators
- Matching Operators
- Loops
- Splatting
- Hashtables, Arrays, and Custom Objects
- Remoting
- WMI
- Registry
- .NET
- Writing Scripts
- Functions vs. Advanced Functions
- Comment-based help
- Writing code for sharing
- Testing Scripts & Test-driven Development
- Project
- Persistence with PowerShell
- Registry
- File
- WMI
- Scheduled Task
- I dunno, forensication?
- Persistence with PowerShell
Exercises
- Launching PowerShell
- Create a profile
- Get/Set Execution Policy
- Updating Help (locally, possibly no internet)
- Get-ChildItem
- verb-noun
- positional parameters
- filtering
- Intro to Editors - Interactive Development
- PowerShell ISE
- VS Code
- Basic syntax:
- Assign variables
- Compare variables
- -eq
- -like
- -match
- -contains
- -gt
- -ge
- -lt
- -le
- -is
- ...you get the picture
- Hashtables, Arrays, and Custom Objects
- Hashtables
- Create a hashtable
- Enumerate hashtable
- Add hashtable item
- Arrays
- Create an array
- Add array items
- Hashtables
Class Projects
- Write a Persistence mechanism multiple ways
- Get information about a remote host
- Use remoting
- Use WMI
- Registry
- Get some event logs or other forensic info