Benign powershell Download

EguibarIT 1.85.143

PowerShell adds privileged group membershipPowerShell removes privileged group membership

SHA-2566a83f3201a932cc85d8675a6ee25910b0c328fc6b15ab9210c93ddf55a2b87e1

URLhttps://www.powershellgallery.com/api/v2/package/EguibarIT/1.85.143

MaleculeK(Li)O₁₀(AsC₃CoDy₃Er₃ILa₂PSXe₅)H₈(Os₂₁Cm₁₂CrDb₅F₁₁Mg₂Po₉U)Md₂(Pa₂)

Evidence

Hardcoded Windows root path (C:\, D:\, etc.) New-LapsObject.ps1 · lines 44–51

8…      - Tier-specific configurations
45
          Default value: 'C:\PsScripts\Config.xml'
47
          Validation:
          - Must exist and be accessible
          - Must contain valid XML structure
          …

Operating system fingerprinting New-LapsObject.ps1 · lines 51–58

56… nts
52
      .EXAMPLE
          New-LAPSobject -ConfigXMLFile 'C:\Config\Enterprise.xml' -Verbose
55
          Description:
          Configures LAPS using production configuration file:
          1. Validates X …

Uses PowerShell to add group membership New-LapsObject.ps1 · lines 314–326

20…  Proceeding to configure it by extending the Schema.'
315
                  # Temporarily add to Schema Admins if needed
                  $isSchemaAdmin = (Get-ADUser $env:UserName -Properties memberof).memberof -like 'CN=Schema Admins*'
                  if (-not $isSchemaAdmin) {
                      Write-Verbose -Message 'Member is not a Schema Admin... adding it.'
                      Add-ADGroupMember -Identity 'Schema Admins' -Members $env:username
                  }#end if
322
⋯4 lines

Uses PowerShell to remove group membership New-LapsObject.ps1 · lines 337–346

64… rom Schema Admin
                      if (-not $isSchemaAdmin) {
                          Remove-ADGroupMember -Identity 'Schema Admins' -Members $env:username -Confirm:$false
                      }
                  } #end Try-Catch-Finally
⋯5 lines

References a privileged domain group New-Tier0GpoRestriction.ps1 · lines 296–302

17… tch {
              Write-Debug -Message ('Failed to retrieve Domain Admins group: {0}' -f $_.Exception.Message)
              $null
          }
      }
301
      $EnterpriseAdmins = Get-SafeVariabl …

Showing the top 5 files — 7 more files (74 regions) not shown.

No evidence locations were recorded for this file. Raw result