Check-LocalAdminHash & Exfiltrating All PowerShell History

Beau Bullock// TL;DR Check-LocalAdminHash is a new PowerShell script that can check a password hash against multiple hosts to determine if it’s a valid administrative credential. It also has the ability to exfiltrate all PowerShell PSReadline console history files from every profile on every system that the credential provided is an administrator of. Get Check-LocalAdminHash […]

Read the entire post here