PowerShell Remoting

PowerShell Remoting is a comprehensive built-in remoting subsystem that is a part of Microsoft's native Windows management framework (WMF) and Windows remote management (WinRM). This feature allows you to handle most remoting tasks in any configuration you might encounter by creating a remote PowerShell session to Windows hosts and executing commands in the created session. The integration includes out-of-the-box commands which supports agentless forensics for remote hosts.

Category

Utilities

Pack

PowershellRemoting

Configuration parameters

• domain — Domain
• dns — DNS
• credentials — Username (required)
• host — Test Host
• auth_method — Authentication Method (required)
• insecure — Trust any certificate (not secure)
• ssl — Use SSL (HTTPS)

Commands (7)

• ps-remote-command — Executes remote PowerShell commands on a single host.
• ps-remote-download-file — Downloads a file from the remote endpoint.
• ps-remote-etl-create-start — This command starts the recording of an ETL file on a Windows endpoint. An ETL file is just like a PCAP file which is created by the Windows Netsh command.
• ps-remote-etl-create-stop — Ends the recording of an ETL file on a Windows endpoint.
• ps-remote-export-mft — Extracts the master file table from the volume.
• ps-remote-export-registry — Exports the specified registry of hive to a file.
• ps-remote-upload-file — Uploads a file to the remote endpoint.