PowerShell Remoting

PowerShell Remoting is a comprehensive built-in remoting subsystem that is a part of Microsoft's native Windows management framework (WMF) and Windows remote management (WinRM). This feature allows you to handle most remoting tasks in any configuration you might encounter by creating a remote PowerShell session to Windows hosts and executing commands in the created session. The integration includes out-of-the-box commands which supports agentless forensics for remote hosts.

Utilities · Powershell Remoting

Configuration parameters

  • domain — Domain
  • dns — DNS
  • credentials — Username (required)
  • host — Test Host
  • auth_method — Authentication Method (required)
  • insecure — Trust any certificate (not secure)
  • ssl — Use SSL (HTTPS)

Commands (7)

  • ps-remote-command

    Executes remote PowerShell commands on a single host.

  • ps-remote-download-file

    Downloads a file from the remote endpoint.

  • ps-remote-etl-create-start

    This command starts the recording of an ETL file on a Windows endpoint. An ETL file is just like a PCAP file which is created by the Windows Netsh command.

  • ps-remote-etl-create-stop

    Ends the recording of an ETL file on a Windows endpoint.

  • ps-remote-export-mft

    Extracts the master file table from the volume.

  • ps-remote-export-registry

    Exports the specified registry of hive to a file.

  • ps-remote-upload-file

    Uploads a file to the remote endpoint.