#PowerShell
All CosmicBytez Labs articles tagged #PowerShell, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-107780: Unauthenticated OS Command Injection in Dromara Skyeye TTS Endpoint
Unauthenticated OS command injection in Dromara Skyeye's TTS endpoint lets attackers break out of a PowerShell string via the format parameter for RCE.
- News
Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels
A new ClickFix variant tricks victims into running PowerShell in Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel backdoor.
- News
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
- Security
CVE-2026-50523: Microsoft PowerShell Local Command Injection Vulnerability
A command injection flaw in Microsoft PowerShell allows authorized local attackers to execute arbitrary code via improper input neutralization.
- HOWTO
How to Detect and Block ClickFix Attacks
Learn how to detect and prevent ClickFix social engineering attacks using EDR rules, network monitoring, YARA signatures, and endpoint hardening. Covers...
- HOWTO
Windows Server Hardening: A Complete Security Guide for Enterprises
Step-by-step Windows Server hardening covering CIS benchmarks, attack surface reduction, service hardening, firewall rules, credential protection, and...
- News
ClickFix Attacks Evolve to Abuse DNS nslookup for Payload Delivery
Microsoft discloses a new ClickFix variant that uses DNS nslookup commands to retrieve and execute malicious PowerShell payloads, marking the first known...
- HOWTO
Active Directory Health Check: Comprehensive Diagnostic
Run thorough health checks on Active Directory infrastructure including Domain Controllers, replication, DNS, SYSVOL, FSMO roles, and critical services...
- HOWTO
Configuring Windows LAPS: Automated Local Admin Password
Deploy and configure Local Administrator Password Solution (LAPS) to automatically manage local administrator passwords across domain-joined computers,...
- HOWTO
IT Service Dashboards with PowerShell Universal
Build interactive IT service management dashboards using PowerShell Universal. Create real-time client portals, automated ticketing views, and...
- HOWTO
Enterprise BitLocker Automation with PowerShell
Deploy and manage BitLocker encryption at scale using PowerShell, with automatic TPM validation, recovery key backup to Azure AD and NinjaRMM, and...
- HOWTO
Exchange Online Security Hardening for Enterprise
Secure your Exchange Online environment with mail flow rules, anti-spam policies, DMARC enforcement, admin audit controls, and mailbox permission hardening.
- HOWTO
FortiGate Firewall Policy Management with PowerShell
Automate FortiGate firewall policy creation, backup, and auditing using PowerShell and the FortiOS REST API. Includes bulk rule deployment, change...
- HOWTO
NinjaOne Scripting: PowerShell Automation Library
Build a comprehensive PowerShell automation library for NinjaOne RMM. Covers script library setup, custom fields, scheduled scripts, and condition-based...
- HOWTO
SentinelOne Threat Hunting Recipes: Practical Deep
A practical recipe book of Deep Visibility hunts — encoded PowerShell, LOLBin abuse, lateral movement, persistence mechanisms. Each recipe is a copy-paste S1QL.
- Project
SentinelOne Complete Deployment Guide
Full deployment lifecycle for SentinelOne EDR - agent rollout, policy configuration, exclusions, threat hunting queries, and response playbooks.
- HOWTO
Windows Security Baseline Audit: CIS Benchmark Compliance
Automate Windows security baseline checks using PowerShell. Validate configurations against CIS benchmarks for password policies, audit settings, and...
- HOWTO
Windows Security Event Log Analysis: Detect Threats with PowerShell
Learn to analyze Windows Security Event Logs to detect brute force attacks, lateral movement, privilege escalation, and other security threats using PowerShell.