NtObjectManager

1.0.3

This module adds a provider and cmdlets to access the NT object manager namespace.

Minimum PowerShell version

3.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name NtObjectManager -RequiredVersion 1.0.3

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deloy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Author(s)

James Forshaw

Copyright

(c) 2016, 2017 Google Inc. All rights reserved.

Owners

Tags

security defence offence sandbox

Cmdlets

Get-NtEvent New-NtEvent Get-NtProcess Get-NtSemaphore New-NtSemaphore Get-NtThread Get-NtTokenPrimary Get-NtTokenThread Get-NtTokenEffective Get-NtHandle Get-NtDirectory New-NtDirectory Get-NtFile New-NtFile Get-NtFileReparsePoint Remove-NtFileReparsePoint Get-NtKey New-NtKey Add-NtKey Get-NtMutant New-NtMutant Get-NtObject New-NtSecurityDescriptor Use-NtObject Get-NtType Get-NtSymbolicLink Get-NtSymbolicLinkTarget New-NtSymbolicLink Start-NtWait

Dependencies

This module has no dependencies.

Release Notes

1.0.3
-----
* Fixed small bug in handling of IO_STATUS_BLOCK which could result in memory corruption.
* Added support to list directory entries for a file directory.
* Added support to do basic read and writes to a file.
1.0.2
-----
* Added support to disable dynamic code policy on a process.
* Added cmdlets for reparse points.
* Fixes for EA buffer.
* Added service SIDs.
* Added support for removing token privileges.
* Fixed token security attribute parsing.
1.0.1
-----
* Fixed bug in Get-NtThread with -ProcessId
* Added support for FilterScript for Get-NtThread
* Added support for querying thread dynamic code opt-out policy
* Added support for RFG mitigation
1.0.0
-----
Initial release:
* NT Object Manager drive provider
* Cmdlets to directory work with Directorys, Files, Symbolic Links, Events, Semaphores, Processes, Threads, Tokens etc.

Version History

Version Downloads Last updated
1.1.24 91 12/10/2019
1.1.23 911 10/15/2019
1.1.22 2,237 4/30/2019
1.1.21 40 4/23/2019
1.1.20 301 3/9/2019
1.1.19 174 2/4/2019
1.1.18 17 2/4/2019
1.1.17 606 9/9/2018
1.1.16 160 8/1/2018
1.1.15 195 6/18/2018
1.1.14 225 5/1/2018
1.1.13 94 4/4/2018
1.1.12 227 3/19/2018
1.1.11 79 3/4/2018
1.1.10 20 3/1/2018
1.1.9 55 2/22/2018
1.1.8 73 2/6/2018
1.1.7 83 1/11/2018
1.1.6 88 12/3/2017
1.1.5 33 11/23/2017
1.1.4 54 11/14/2017
1.1.3 38 11/5/2017
1.1.2 79 10/11/2017
1.1.1 125 8/30/2017
1.1.0 8 8/30/2017
1.0.9 75 8/19/2017
1.0.8 48 8/7/2017
1.0.7 130 6/14/2017
1.0.6 201 5/24/2017
1.0.5 12 5/24/2017
1.0.4 25 5/17/2017
1.0.3 (current version) 77 2/23/2017
1.0.2 32 2/8/2017
1.0.1 168 11/3/2016
1.0 91 11/1/2016
Show less