Blue team cookbook

In the following subsections, you will find some code snippets that come in handy for your daily life as a blue team PowerShell practitioner. Blue teaming is quite extensive; therefore, you won’t find use cases for every scenario but, rather, some of the basics.

Also, refer to Chapter 8, Red Team Tasks and Cookbook, as you will find many red teamer code snippets and scripts there that can also sometimes be useful for a blue teamer.

Checking for installed updates

You want to find out which updates were installed on one or more remote systems.

Solution

You can use the Get-InstalledUpdates.ps1 script to scan an IP range for installed Windows updates. You can find the script in the GitHub repository of this chapter: https://github.com/PacktPublishing/PowerShell-Automation-and-Scripting-for-Cybersecurity/blob/master/Chapter09/Get-InstalledUpdates.ps1.

Use this example to scan the 172.29.0.10-20 IP range for installed updates:

> .\Get-InstalledUpdates...