PowerSponse Module

Description

PowerSponse is a PowerShell module for working during targeted remediation.

See CoRe rules for more information about the cleanup rules.

PowerSponse Cmdlets

Disable-NetworkInterface

Disable a network interface.

Disable-RemoteRegistry

Disable the RemoteRegistry service.

Disable-ScheduledTask

Disable a scheduled task.

Disable-Service

Disable a service.

Enable-NetworkInterface

Enable a network interface.

Enable-RemoteRegistry

Enable the RemoteRegistry service.

Enable-ScheduledTask

Enable a scheduled task.

Enable-Service

Enable a service.

Find-Directory

Find directory based on wildcards or regex.

Find-File

Find file based on wildcards or regex.

Get-Autoruns

Collect Sysinternal's Autoruns output.

Get-FileHandle

Get file handle information for a PID or a process name.

Get-NetworkInterface

Read network interface information based on either the network interface index or based on the interface description.

Get-PowerSponseRepository

Reads PowerSponse repository.

Get-PowerSponseRule

Reads a given CoRe rule file and print the rule.

Get-Process

Find processes based on regex.

Get-ScheduledTask

Find scheduled tasks based on regex.

Import-PowerSponseRepository

Reload the PowerSponse repository from the file.

Invoke-PowerSponse

Read the CORE rules and invokes all defined cleanup commands.

Invoke-PsExec

Executes a given program on a remote host.

New-CleanupPackage

Creates a new cleanup package.

Remove-Directory

Remove directory based on wildcards or regex.

Remove-File

Remove file based on wildcards or regex.

Restart-Computer

Restart a computer.

Set-PowerSponseRepository

Set a new PowerSponse repository for the current session.

Start-Service

Start a service.

Stop-Computer

Shutdown computer.

Stop-Process

Stop a process based on regex.

Stop-Service

Stop a service.