NtObjectManager

1.0.2

This module adds a provider and cmdlets to access the NT object manager namespace.

Minimum PowerShell version

3.0

There is a newer prerelease version of this module available.
See the version list below for details.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name NtObjectManager -RequiredVersion 1.0.2

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name NtObjectManager -Version 1.0.2

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2016 Google Inc. All rights reserved.

Package Details

Author(s)

  • James Forshaw

Tags

security defence offence sandbox

Cmdlets

Get-NtEvent New-NtEvent Get-NtProcess Get-NtSemaphore New-NtSemaphore Get-NtThread Get-NtTokenPrimary Get-NtTokenThread Get-NtTokenEffective Get-NtHandle Get-NtDirectory New-NtDirectory Get-NtFile New-NtFile Get-NtFileReparsePoint Remove-NtFileReparsePoint Get-NtKey New-NtKey Add-NtKey Get-NtMutant New-NtMutant Get-NtObject New-NtSecurityDescriptor Use-NtObject Get-NtType Get-NtSymbolicLink Get-NtSymbolicLinkTarget New-NtSymbolicLink Start-NtWait

Dependencies

This module has no dependencies.

Release Notes

1.0.2
-----
* Added support to disable dynamic code policy on a process.
* Added cmdlets for reparse points.
* Fixes for EA buffer.
* Added service SIDs.
* Added support for removing token privileges.
* Fixed token security attribute parsing.
1.0.1
-----
* Fixed bug in Get-NtThread with -ProcessId
* Added support for FilterScript for Get-NtThread
* Added support for querying thread dynamic code opt-out policy
* Added support for RFG mitigation
1.0.0
-----
Initial release:
* NT Object Manager drive provider
* Cmdlets to directory work with Directorys, Files, Symbolic Links, Events, Semaphores, Processes, Threads, Tokens etc.

FileList

Version History

Version Downloads Last updated
2.0.1 98,054 11/15/2023
2.0.0 3,952 9/12/2023
2.0.0-alpha2... 26 8/31/2023
1.1.33 42,403 1/22/2022
1.1.32 54,604 8/18/2021
1.1.31 4,667 3/16/2021
1.1.30 1,052 1/15/2021
1.1.29 1,071 11/23/2020
1.1.28 2,223 6/30/2020
1.1.27 2,176 2/10/2020
1.1.26 499 1/21/2020
1.1.25 491 1/2/2020
1.1.24 520 12/10/2019
1.1.23 965 10/15/2019
1.1.22 2,629 4/30/2019
1.1.21 207 4/23/2019
1.1.20 1,217 3/9/2019
1.1.19 211 2/4/2019
1.1.18 44 2/4/2019
1.1.17 681 9/9/2018
1.1.16 191 8/1/2018
1.1.15 241 6/18/2018
1.1.14 382 5/1/2018
1.1.13 120 4/4/2018
1.1.12 335 3/19/2018
1.1.11 142 3/4/2018
1.1.10 53 3/1/2018
1.1.9 86 2/22/2018
1.1.8 100 2/6/2018
1.1.7 109 1/11/2018
1.1.6 116 12/3/2017
1.1.5 59 11/23/2017
1.1.4 86 11/14/2017
1.1.3 76 11/5/2017
1.1.2 155 10/11/2017
1.1.1 378 8/30/2017
1.1.0 44 8/30/2017
1.0.9 103 8/19/2017
1.0.8 75 8/7/2017
1.0.7 211 6/14/2017
1.0.6 291 5/24/2017
1.0.5 40 5/24/2017
1.0.4 52 5/17/2017
1.0.3 104 2/23/2017
1.0.2 (current version) 57 2/8/2017
1.0.1 287 11/3/2016
1.0 152 11/1/2016
Show less