Merge pull request #121 from fireeye/february_2020

February 2020
2026-10-12 02:18:39 +00:00 · 2020-03-12 15:50:46 -05:00
parent abad0be1a1 cca9e5af51
commit 69cfed62e4
16 changed files with 1350 additions and 620 deletions
@@ -7,14 +7,14 @@
               \/             \/      \/     \/     \/      \/       
                        C O M P L E T E  M A N D I A N T                    
                             O F F E N S I V E   V M                        
-                                   Version 2.0                                 
+                                  Version 2020.1                                 
                              commandovm@fireeye.com
               _____________________________________________________          

-                                   Developed by                                
-                                   Jake Barteaux                               
+                                    Created by                                
+                             Jake Barteaux @day1player                              
                                 Mandiant Red Team  
-                                  Blaine Stancill                           
+                          Blaine Stancill @MalwareMechanic                           
                                    Nhan Huynh   
                     FireEye Labs Advanced Reverse Engineering                            
 ______________________________________________________________________________ 
@@ -32,18 +32,19 @@ Installation (Install Script)

 Requirements
 ------------
-* Windows 7 Service Pack 1 or Windows 10
+* Windows 10 1803, 1809, 1903 or 1909
+  * Windows 7 is no longer supported. Install should work but issues will not be resolved. New tools will not be added but can be manually installed.
 * 60 GB Hard Drive
 * 2 GB RAM

 Recommended
 -----------
-* Windows 10
+* Windows 10 1903
 * 80+ GB Hard Drive
 * 4+ GB RAM
 * 2 network adapters
 * Enable Virtualization support for VM
-  * REQUIRED FOR KALI OR DOCKER
+  * Required for Kali or Docker

 Instructions
 ============
@@ -51,12 +52,12 @@ Standard install
 ----------------
 1. Create and configure a new Windows Virtual Machine
  * Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain 
-* Take a snapshot of your machine!
-* Download and copy `install.ps1` on your newly configured machine. 
-* Open PowerShell as an Administrator
-* Enable script execution by running the following command:
-  * `Set-ExecutionPolicy Unrestricted`
-* Finally, execute the installer script as follows:
+2.  Take a snapshot of your machine!
+3.  Download and copy `install.ps1` on your newly configured machine. 
+4.  Open PowerShell as an Administrator
+5.  Unblock the install file by running `Unblock-File .\install.ps1`
+6.  Enable script execution by running `Set-ExecutionPolicy Unrestricted -f`
+7.  Finally, execute the installer script as follows:
  * `.\install.ps1`
  * You can also pass your password as an argument: `.\install.ps1 -password <password>`
  
@@ -101,7 +102,6 @@ Installed Tools

 ### Command & Control
 - Covenant
- PoshC2
 - WMImplant
 - WMIOps

@@ -137,6 +137,7 @@ Installed Tools
 - PowerLessShell
 - PowerShdll
 - StarFighters
+- SysWhispers

 ### Exploitation
 - ADAPE-Script
@@ -144,10 +145,12 @@ Installed Tools
 - CrackMapExec
 - CrackMapExecWin
 - DAMP
+- Dumpert
 - EvilClippy
 - Exchange-AD-Privesc
 - FuzzySec's PowerShell-Suite
 - FuzzySec's Sharp-Suite
+- GadgetToJScript
 - Generate-Macro
 - GhostPack
  - Rubeus
@@ -173,6 +176,7 @@ Installed Tools
 - NetshHelperBeacon
 - Nishang
 - Orca
+- PSBits
 - PSReflect
 - PowerLurk
 - PowerPriv
@@ -186,6 +190,8 @@ Installed Tools
 - SharpExec
 - SpoolSample
 - SharpSploit
+- ThreadContinue
+- TikiTorch
 - UACME
 - impacket-examples-windows
 - vssown
@@ -196,22 +202,27 @@ Installed Tools
 - ADExplorer
 - ADOffline
 - ADRecon
+- BeRoot
 - BloodHound
+- BloodHound-Custom-Queries (Hausec)
 - dnsrecon
 - FOCA
 - Get-ReconInfo
 - GoBuster
 - GoWitness
+- Net-GPPPassword
 - NetRipper
 - Nmap
 - PowerView
  - Dev branch included
+- Privesc (enjoiz)
+- Recon-AD
 - SharpHound
 - SharpView
 - SpoolerScanner
 - Watson

-## Kali Linux
+### Kali Linux
 - kali-linux-default
 - kali-linux-xfce
 - VcXsrv
@@ -219,6 +230,7 @@ Installed Tools
 ### Networking Tools
 - Citrix Receiver
 - OpenVPN
+- Powercat
 - Proxycap
 - PuTTY
 - Telnet
@@ -266,22 +278,28 @@ Installed Tools
 - Gimp
 - Greenshot
 - Hashcheck
+- HeidiSQL
 - Hexchat
+- HTTP File Server (hfs)
 - HxD
 - Keepass
 - MobaXterm
 - Mozilla Thunderbird
 - Neo4j Community Edition
+- NirLauncher
 - Notepad++
 - Pidgin
 - Process Hacker 2
+- qBittorrent
 - SQLite DB Browser
 - Screentogif
 - Shellcode Launcher
+- SimpleDNSCrypt
+- SQLite DB Browser
 - Sublime Text 3
+- Tor Browser
 - TortoiseSVN
 - VLC Media Player
- Winrar
 - yEd Graph Tool

 ### Vulnerability Analysis
@@ -289,7 +307,7 @@ Installed Tools
 - Egress-Assess
 - Grouper2
 - NtdsAudit
- PwndPasswordsNTLM
+- PwnedPasswordsNTLM
 - zBang

 ### Web Applications
@@ -321,119 +339,5 @@ installation, you are accepting the license terms of each package, and
 acknowledging that your use of each package will be subject to its respective
 license terms.

-List of package licenses:
-
-http://technet.microsoft.com/en-us/sysinternals/bb469936
-https://github.com/stufus/ADOffline/blob/master/LICENCE.md
-https://github.com/HarmJ0y/ASREPRoast/blob/master/LICENSE
-https://github.com/BloodHoundAD/BloodHound/blob/master/LICENSE.md
-https://github.com/Arvanaghi/CheckPlease/blob/master/LICENSE
-https://github.com/cobbr/Covenant/blob/master/LICENSE
-https://github.com/byt3bl33d3r/CrackMapExec/blob/master/LICENSE
-https://github.com/Raikia/CredNinja/blob/master/LICENSE
-https://github.com/MichaelGrafnetter/DSInternals/blob/master/LICENSE.md
-https://github.com/tyranid/DotNetToJScript/blob/master/LICENSE
-https://github.com/FortyNorthSecurity/Egress-Assess/blob/master/LICENSE
-https://github.com/cobbr/Elite/blob/master/LICENSE
-https://github.com/GoFetchAD/GoFetch/blob/master/LICENSE.md
-http://www.gnu.org/licenses/gpl.html
-https://github.com/Kevin-Robertson/Inveigh/blob/master/LICENSE.md
-https://github.com/danielbohannon/Invoke-CradleCrafter/blob/master/LICENSE
-https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/LICENSE
-https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/LICENSE
-https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/LICENSE.md
-https://github.com/denandz/KeeFarce/blob/master/LICENSE
-https://github.com/HarmJ0y/KeeThief/blob/master/LICENSE
-https://github.com/gentilkiwi/mimikatz
-https://github.com/nettitude/PoshC2/blob/master/LICENSE
-https://github.com/Mr-Un1k0d3r/PowerLessShell/blob/master/LICENSE.md
-https://github.com/G0ldenGunSec/PowerPriv/blob/master/LICENSE
-https://github.com/p3nt4/PowerShdll/blob/master/LICENSE.md
-https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/LICENSE
-https://github.com/PowerShellMafia/PowerSploit/blob/master/LICENSE
-https://github.com/PowerShellMafia/PowerSploit/blob/master/LICENSE
-https://github.com/dirkjanm/PrivExchange/blob/master/LICENSE
-https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts/blob/master/LICENSE.md
-https://github.com/cyberark/RiskySPN/blob/master/LICENSE.md
-https://github.com/GhostPack/Rubeus/blob/master/LICENSE
-https://github.com/GhostPack/SafetyKatz/blob/master/LICENSE
-https://github.com/NickeManarin/ScreenToGif/blob/master/LICENSE.txt
-https://github.com/GhostPack/Seatbelt
-https://github.com/danielmiessler/SecLists/blob/master/LICENSE
-https://github.com/Arvanaghi/SessionGopher
-https://github.com/GhostPack/SharpDPAPI/blob/master/LICENSE
-https://github.com/GhostPack/SharpDump/blob/master/LICENSE
-https://github.com/tevora-threat/SharpView/blob/master/LICENSE
-https://github.com/GhostPack/SharpRoast/blob/master/LICENSE
-https://github.com/GhostPack/SharpUp/blob/master/LICENSE
-https://github.com/GhostPack/SharpWMI/blob/master/LICENSE
-https://github.com/leechristensen/SpoolSample/blob/master/LICENSE
-https://github.com/vletoux/SpoolerScanner/blob/master/LICENSE
-http://www.sublimetext.com/eula
-https://github.com/HarmJ0y/TrustVisualizer/blob/master/LICENSE
-https://github.com/hfiref0x/UACME/blob/master/LICENSE.md
-https://github.com/FortyNorthSecurity/WMIOps/blob/master/LICENSE
-https://github.com/FortyNorthSecurity/WMImplant/blob/master/LICENSE
-http://www.adobe.com/products/eulas/pdfs/Reader10_combined-20100625_1419.pdf
-http://www.rohitab.com/apimonitor
-http://www.autoitscript.com/autoit3/docs/license.htm
-https://portswigger.net/burp
-http://www.citrix.com/buy/licensing/agreements.html
-https://github.com/cmderdev/cmder/blob/master/LICENSE
-https://github.com/nccgroup/demiguise/blob/master/LICENSE.txt
-http://www.telerik.com/purchase/license-agreement/fiddler
-https://www.mozilla.org/en-US/MPL/2.0/
-https://github.com/fireeye/flare-floss
-https://github.com/fuzzdb-project/fuzzdb/blob/master/_copyright.txt
-https://www.gimp.org/about/
-https://www.google.it/intl/en/chrome/browser/privacy/eula_text.html
-https://github.com/sensepost/gowitness/blob/master/LICENSE.txt
-https://github.com/hashcat/hashcat/blob/master/docs/license.txt
-https://www.gnu.org/licenses/gpl-2.0.html
-https://mh-nexus.de/en/hxd/license.php
-https://github.com/SecureAuthCorp/impacket/blob/master/LICENSE
-https://github.com/SecureAuthCorp/impacket/blob/master/LICENSE
-https://www.kali.org/about-us/
-http://keepass.info/help/v2/license.html
-https://github.com/putterpanda/mimikittenz
-http://mobaxterm.mobatek.net/license.html
-http://neo4j.com/open-source-project/
-https://github.com/samratashok/nishang/blob/master/LICENSE
-https://svn.nmap.org/nmap/COPYING
-https://github.com/Ben0xA/nps/blob/master/LICENSE
-https://openvpn.net/index.php/license.html
-https://www.microsoft.com/en-us/servicesagreement/
-https://github.com/joesecurity/pafishmacro/blob/master/LICENSE
-https://hg.pidgin.im/pidgin/main/file/f02ebb71b5e3/COPYING
-http://www.proxycap.com/eula.pdf
-http://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html
-https://support.microsoft.com/en-us/gp/mats_eula
-https://raw.githubusercontent.com/sqlitebrowser/sqlitebrowser/master/LICENSE
-http://technet.microsoft.com/en-us/sysinternals/bb469936
-http://www.mozilla.org/en-US/legal/eula/thunderbird.html
-http://www.videolan.org/legal.html
-http://www.vmware.com/download/eula/universal_eula.html
-https://www.vmware.com/help/legal.html
-https://www.realvnc.com/legal/
-https://code.visualstudio.com/License
-http://go.microsoft.com/fwlink/?LinkID=251960
-http://opensource.org/licenses/BSD-3-Clause
-https://winscp.net/docs/license
-http://www.gnu.org/copyleft/gpl.html
-https://github.com/x64dbg/x64dbg/blob/development/LICENSE
-https://www.yworks.com/products/yed/license.html
-http://www.apache.org/licenses/LICENSE-2.0
-https://github.com/Dionach/NtdsAudit/blob/master/LICENSE
-https://github.com/ANSSI-FR/AD-control-paths/blob/master/LICENSE.txt
-https://github.com/OJ/gobuster/blob/master/LICENSE
-https://github.com/xmendez/wfuzz/blob/master/LICENSE
-https://github.com/dafthack/DomainPasswordSpray/blob/master/LICENSE
-https://github.com/nettitude/PoshC2_Python/blob/master/LICENSE
-https://github.com/ElevenPaths/FOCA/blob/master/LICENSE.txt
-https://github.com/ohpe/juicy-potato/blob/master/LICENSE
-https://github.com/NytroRST/NetRipper/blob/master/LICENSE.TXT
-https://github.com/unixrox/prebellico/blob/master/LICENSE.md
-https://github.com/rasta-mouse/Watson/blob/master/LICENSE.txt
-https://github.com/berzerk0/Probable-Wordlists/blob/master/License.txt
-https://github.com/cobbr/SharpSploit/blob/master/LICENSE
+Licenses for each package can be found in the packages.csv file for this repository.
 </pre>
@@ -1,3 +1,40 @@
+## 2020.1 - March 3 2020
+- added logic to attempt automatically updating system #88
+- added qbittorrent #88
+- added dbeaver #88
+- added hfsexplorer #88
+- added lockhunter #88
+- fixed typo for PwnedPasswordsNTLM in packages.json #101
+- added BeRoot
+- added BloodHound Custom Queries - Hausec
+- added Dumpert
+- added Recon-AD
+- added Net-GPPPassword
+- added Gadget2JScript
+- added OffensiveCSharp - matterpreter
+- added powercat
+- added Privesc - enjoiz
+- added PSBits
+- added ThreadContinue
+- added SysWhispers
+- added TikiTorch
+- added Virus Total Uploader #88
+- added NirLauncher #88
+- added SimpleDnsCrypt #88
+- added Tor Browser #88
+- added HeidiSQL #88
+- added HTTP File Server #88
+- Removed support for Windows 7 (install should still work, but is no longer maintained)
+- improved error handling for commandovm.win10.config.fireeye package
+- updated commandovm.win10.preconfig.fireeye
+- Fixed taskbar pinning on 1903 (still not working for 1909)
+- Updated install instructions on readme
+- Updated ~45 packages
+- Removed Watson binaries (static binaries are not updated in this repo)
+- Removed PoshC2 (deprecated, will look at supporting PoshC2 Python)
+- Removed Covenant (will support again in a future release)
+- Removed Elite (deprecated)
+
 ## 2.0 - August 5 2019
 - Added Kali Linux https://www.kali.org
 - Added Docker https://www.docker.com #88
@@ -2,11 +2,13 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
  <metadata>
    <id>commandovm.win10.config.fireeye</id>
-    <version>2.0.0.0</version>
+    <version>2.0.0.5</version>
    <title>CommandoVM</title>
    <authors>Jake Barteaux</authors>
    <description>CommandoVM - Penetration Testing Distribution</description>    
    <dependencies>
+      <dependency id="common.fireeye" />
+      <dependency id="syspin" />
      <dependency id="autohotkey.portable" />
    </dependencies>
  </metadata>
@@ -1,46 +1,8 @@
-$ErrorActionPreference = 'Stop'
+$ErrorActionPreference = 'Continue'

 $packageName = 'commandovm.win10.config.fireeye'
 $toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"

-function PinToTaskbar {
-  # https://stackoverflow.com/questions/31720595/pin-program-to-taskbar-using-ps-in-windows-10
-  param (
-    [parameter(Mandatory=$True, HelpMessage="Target item to pin")]
-    [ValidateNotNullOrEmpty()]
-    [string] $Target
-  )
-  if (-Not (Test-Path $Target)) {
-    Write-Warning "$Target does not exist"
-    throw [System.IO.FileNotFoundException] "$Target does not exist"
-  }
-
-  $KeyPath1  = "HKCU:\SOFTWARE\Classes"
-  $KeyPath2  = "*"
-  $KeyPath3  = "shell"
-  $KeyPath4  = "{:}"
-  $ValueName = "ExplorerCommandHandler"
-  $ValueData =
-    (Get-ItemProperty `
-        ("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\" + `
-            "CommandStore\shell\Windows.taskbarpin")
-    ).ExplorerCommandHandler
-
-  $Key2 = (Get-Item $KeyPath1).OpenSubKey($KeyPath2, $true)
-  $Key3 = $Key2.CreateSubKey($KeyPath3, $true)
-  $Key4 = $Key3.CreateSubKey($KeyPath4, $true)
-  $Key4.SetValue($ValueName, $ValueData)
-
-  $Shell = New-Object -ComObject "Shell.Application"
-  $Folder = $Shell.Namespace((Get-Item $Target).DirectoryName)
-  $Item = $Folder.ParseName((Get-Item $Target).Name)
-  $Item.InvokeVerb("{:}")
-
-  $Key3.DeleteSubKey($KeyPath4)
-  if ($Key3.SubKeyCount -eq 0 -and $Key3.ValueCount -eq 0) {
-    $Key2.DeleteSubKey($KeyPath3)
-  }
-}

 ### Commando Windows 10 Attack VM ###
 Write-Host "[+] Beginning host configuration..." -ForegroundColor Green
@@ -63,11 +25,16 @@ Start-Sleep -Seconds 2

 #### Remove Desktop Shortcuts ####
 Write-Host "[+] Cleaning up the Desktop" -ForegroundColor Green
-$shortcut_path = "C:\Users\Public\Desktop\Boxstarter Shell.lnk"
-Remove-Item $shortcut_path -Force | Out-Null
-Start-Sleep -Seconds 2
+$shortcut_path = "$Env:Public\Desktop\Boxstarter Shell.lnk"
+if (Test-Path $shortcut_path) { Remove-Item $shortcut_path -Force -ErrorAction Ignore | Out-Null }
 $shortcut_path = "$Env:USERPROFILE\Desktop\Microsoft Edge.lnk"
-Remove-Item $shortcut_path -Force | Out-Null
+if (Test-Path $shortcut_path) { Remove-Item $shortcut_path -Force  -ErrorAction Ignore | Out-Null }
+$shortcut_path = "$Env:USERPROFILE\Desktop\Google Chrome.lnk"
+if (Test-Path $shortcut_path) { Remove-Item $shortcut_path -Force  -ErrorAction Ignore | Out-Null }
+$shortcut_path = "$Env:USERPROFILE\Desktop\VirusTotal Uploader 2.2.lnk"
+if (Test-Path $shortcut_path) { Remove-Item $shortcut_path -Force  -ErrorAction Ignore | Out-Null }
+$shortcut_path = "$Env:Public\Desktop\Simple DNSCrypt.lnk"
+if (Test-Path $shortcut_path) { Remove-Item $shortcut_path -Force -ErrorAction Ignore | Out-Null }


 #### Add timestamp to PowerShell prompt ####
@@ -87,28 +54,34 @@ Set-Content -Path $profile -Value $psprompt
 #   Offending string: "Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"
 #   Resolves to: "cmd /c 'setx PROMPT COMMANDO$S$d$s$t$_$p$+$g'"
 iex ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"))) | Out-Null
-Write-Host "`t[+] Timestamps added to cmd prompt and PowerShell" -ForegroundColor Green
+Write-Host "[+] Timestamps added to cmd prompt and PowerShell" -ForegroundColor Green

+#### Fix shift+space in powershell
+# https://superuser.com/questions/1365875/shiftspace-not-working-in-powershell
+Set-PSReadLineKeyHandler -Chord Shift+Spacebar -Function SelfInsert
+Write-Host "[+] Fixed shift+space keybinding in PowerShell" -ForegroundColor Green

 #### Pin Items to Taskbar ####
 Write-Host "[-] Pinning items to Taskbar" -ForegroundColor Green
 # Explorer
 $target_file = Join-Path ${Env:WinDir} "explorer.exe"
 try {
-  PinToTaskbar $target_file
+  Write-Host "`tPinning $target_file to taskbar" -ForegroundColor Green
+  syspin.exe "$target_file" 5387
 } catch {
-  Write-Host "Could not pin $target_file to the tasbar"
+  Write-Host "`tCould not pin $target_file to the taskbar" -ForegroundColor Red
 }
 # CMD prompt
 $target_file = Join-Path ${Env:WinDir} "system32\cmd.exe"
 $target_dir = ${Env:UserProfile}
 $target_args = '/K "cd ' + ${Env:UserProfile} + '"'
-$shortcut = Join-Path ${Env:UserProfile} "temp\CMD.lnk"
+$shortcut = Join-Path ${Env:UserProfile} "temp\cmd.lnk"
 Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
 try {
-  PinToTaskbar $shortcut
+  Write-Host "`tPinning $target_file to taskbar" -ForegroundColor Green
+  syspin.exe "$shortcut" 5387
 } catch {
-  Write-Host "Could not pin $target_file to the tasbar"
+  Write-Host "`tCould not pin $target_file to the taskbar" -ForegroundColor Red
 }
 # Powershell
 $target_file = Join-Path (Join-Path ${Env:WinDir} "system32\WindowsPowerShell\v1.0") "powershell.exe"
@@ -117,20 +90,21 @@ $target_args = '-NoExit -Command "cd ' + "${Env:UserProfile}" + '"'
 $shortcut = Join-Path ${Env:UserProfile} "temp\PowerShell.lnk"
 Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
 try {
-  PinToTaskbar $shortcut
+  Write-Host "`tPinning $target_file to taskbar" -ForegroundColor Green
+  syspin.exe "$shortcut" 5387
 } catch {
-  Write-Host "Could not pin $target_file to the tasbar"
+  Write-Host "`tCould not pin $target_file to the taskbar" -ForegroundColor Red
 }


 #### Rename the computer ####
 Write-Host "[+] Renaming host to 'commando'" -ForegroundColor Green
 (Get-WmiObject win32_computersystem).rename("commando") | Out-Null
-Write-Host "`t[-] Make sure to restart the machine for this change to take effect" -ForegroundColor Yellow
-Write-Host "[+] Changing Desktop Background" -ForegroundColor Green
+Write-Host "`t[-] Change will take effect after a restart" -ForegroundColor Yellow


 #### Update background ####
+Write-Host "[+] Changing Desktop Background" -ForegroundColor Green
 # Set desktop background to black
 Set-ItemProperty -Path 'HKCU:\Control Panel\Colors' -Name Background -Value "0 0 0" -Force | Out-Null
 # Set desktop wallpaper using WallpaperChanger utility
@@ -168,7 +142,11 @@ foreach ($item in "0", "1", "2") {
 Write-Host "[+] Copying README.txt to Desktop" -ForegroundColor Green
 $fileReadme = Join-Path $toolsDir 'readme.txt'
 $desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
-Copy-Item $fileReadme $desktopReadme
+try {
+  Copy-Item $fileReadme $desktopReadme -Force -ErrorAction SilentlyContinue
+} catch {
+  Write-Host "Could not copy Readme to Desktop. Please visit github to review."
+}

 # Fix PATH issues with Python installers #18
 $paths = @(
@@ -191,13 +169,21 @@ foreach ($p in $paths) {
 }

 if ($env_path -ne $old_path) {
-    setx /M PATH $env_path
-    refreshenv
+    try {
+      setx /M PATH $env_path
+      refreshenv
+    } catch {
+      Write-Host "Could not set PATH properly, please submit GitHub issue." -ForegroundColor Red
+    }
 }

 # Remove desktop.ini files
-Get-ChildItem -Path (Join-Path ${Env:UserProfile} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
-Get-ChildItem -Path (Join-Path ${Env:Public} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+try {
+  Get-ChildItem -Path (Join-Path ${Env:UserProfile} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+  Get-ChildItem -Path (Join-Path ${Env:Public} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+} catch {
+  Write-Host "Could not remove desktop.ini files"
+}

 # Use AutoHotKey to modify various settings
 $scripts = @(
@@ -213,6 +199,7 @@ ForEach ($name in $scripts) {
 # Should be PS >5.1 now, enable transcription and script block logging
 # More info: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
 if ($PSVersionTable -And $PSVersionTable.PSVersion.Major -ge 5) {
+  Write-Host "Enabling PowerShell Script Block Logging" -ForegroundColor Green
  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell'
  if (-Not (Test-Path $psLoggingPath)) {
    New-Item -Path $psLoggingPath -Force | Out-Null
@@ -6,13 +6,14 @@
               \/             \/      \/     \/     \/      \/       
                        C O M P L E T E  M A N D I A N T                    
                             O F F E N S I V E   V M                        
-                                   Version 1.3                                 
+                                   Version 2020.1
+                                [email protected]                                 
               _____________________________________________________          

-                                   Developed by                                
-                                   Jake Barteaux                               
+                                    Created by                                
+                              Jake Barteaux @day1player                              
                                 Proactive Services  
-                                  Blaine Stancill                          
+                          Blaine Stancill @MalwareMechanic                          
                                    Nhan Huynh   
                     FireEye Labs Advanced Reverse Engineering                            
 ______________________________________________________________________________ 
@@ -25,7 +26,8 @@ back if you have issues.

 This image has the Chocolatey package manager installed, and you can continue to
 customize this machine with any package from the Chocolatey repository - 
-https://chocolatey.org/packages.
+https://chocolatey.org/packages or from our repo - 
+https://github.com/fireeye/commando-vm/blob/master/packages.csv.

 Try this:
  choco install github 
@@ -42,49 +44,8 @@ Please enjoy the VM and submit any feedback or feature requests as github
 issues here:
 https://github.com/fireeye/commando-vm

-Changelog:
-1.3 - June 28 2019
- Added RottenPotatoNG https://github.com/breenmachine/RottenPotatoNG #63
- Added Juicy Potato https://github.com/ohpe/juicy-potato #63, #64
- Added Watson https://github.com/rasta-mouse/Watson #64
- Added PwndPasswordsNTLM https://github.com/JacksonVD/PwnedPasswordsNTLM #67
- Added FOCA https://github.com/JacksonVD/PwnedPasswordsNTLM #71 
- Added Vulcan https://github.com/praetorian-code/vulcan
- Added SharpClipHistory https://github.com/mwrlabs/SharpClipHistory
- Added NetRipper https://github.com/NytroRST/NetRipper
- Added RobotsDisallowed https://github.com/danielmiessler/RobotsDisallowed
- Added Probable-Wordlists https://github.com/berzerk0/Probable-Wordlists
- Added SharpSploit https://github.com/cobbr/SharpSploit
- Changed WinRM configuration #65
- Un-hardened UNC file paths #68
- Fixed install issues with Covenant #61, #78
+For support or questions please join the #commando-vm channel in the BloodHoundGang
+Slack or email the creators at [email protected]

-1.2 - May 31 2019
- Added recommended hardware settings #20, #17
- Added DomainPasswordSpray https://github.com/dafthack/DomainPasswordSpray
- Added GoBuster https://github.com/OJ/gobuster #39
- Added Wfuzz https://github.com/xmendez/wfuzz #40
- Added Notepad++ #30
- Added TextFX plugin for Notepad++
- Added Explorer Suite (CFF Explorer)
-
-1.1 - April 30 2019
- Added AD-Control-Paths https://github.com/ANSSI-FR/AD-control-paths/releases
- Added DefenderCheck https://github.com/matterpreter/DefenderCheck
- Added dnsrecon https://github.com/darkoperator/dnsrecon
- Added EvilClippy https://github.com/outflanknl/EvilClippy
- Added NtdsAudit https://github.com/Dionach/NtdsAudit
- Added SharpExec https://github.com/anthemtotheego/SharpExec
- Added Subdomain-Bruteforce https://github.com/visualbasic6/subdomain-bruteforce
- Fixed issue #18 with PATH 
- Added Commando Logos with transparent backgrounds to $Home\Pictures
- Pinned Firefox to Taskbar
- Fixed misspellings in Readme #42/#43
- Added Ruby and Ruby Devkit #1
- Updated Rubeus package to current version (1.4.2) #31
-
-1.0.2 - April 10 2019
- Added missing 'seclists.fireeye' package to packages.json #38
-
-1.0.1 - March 31 2019
- Used https instead of http to install boxstarter #10
+Keep an eye on our Changelog for new tools:
+https://github.com/fireeye/commando-vm/blob/master/changelog.md
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
  <metadata>
    <id>commandovm.win10.installer.fireeye</id>
-    <version>2.0.0.0</version>
+    <version>2.0.0.1</version>
    <title>CommandoVM</title>
    <authors>Jake Barteaux</authors>
    <description>CommandoVM - Penetration Testing Distribution</description>
@@ -1,9 +1,19 @@
 {
+    "env": {
+        "VM_COMMON_DIR": "%ProgramData%\\FEVM",
+        "TOOL_LIST_DIR": "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Tools",
+        "TOOL_LIST_SHORTCUT": "%UserProfile%\\Desktop\\Tools.lnk",
+        "RAW_TOOLS_DIR": "%SystemDrive%\\Tools",
+        "TEMPLATE_DIR": "commandovm.win10.installer.fireeye"
+    },
    "packages": [
        {"name": "dotnet4.6.2"},
        {"name": "dotnet4.7.2"},
        {"name": "cmder.fireeye"},
-        {"name": "git"},
+        {
+            "name": "git",
+            "args": "--params \'/GitOnlyOnPath /NoShellIntegration\'"
+        },
        {"name": "adobereader.fireeye"},
        {"name": "jre8"},
        {"name": "wireshark.fireeye"},
@@ -51,6 +61,13 @@
        {"name": "vnc-viewer.fireeye"},
        {"name": "hashcat.fireeye"},
        {"name": "hashcheck"},
+        {"name": "qbittorrent"},
+        {"name": "dbeaver"},
+        {"name": "hfsexplorer"},
+        {"name": "lockhunter"},
+        {"name": "simplednscrypt.fireeye"},
+        {"name": "heidisql.fireeye"},
+        {"name": "hfs.fireeye"},
        {
            "name": "neo4j-community.fireeye",
            "x64Only": true
@@ -83,7 +100,10 @@
        {"name": "burp.free.fireeye"},
        {"name": "kali.fireeye", "args": "--timeout 7200"},
        {"name": "kali_windowsbinaries.fireeye"},
+        {"name": "nirlauncher.fireeye"},
        {"name": "unxUtils"},
+        {"name": "virustotaluploader"},
+        {"name": "tor-browser.fireeye"},

        {"name": "ADACLScanner.fireeye"},
        {"name": "ADAPE-Script.fireeye"},
@@ -92,9 +112,12 @@
        {"name": "amass.docker.fireeye"},
        {"name": "ASREPRoast.fireeye"},
        {"name": "BloodHound.fireeye"},
+        {"name": "BeRoot.fireeye"},
+        {"name": "Bloodhound-Custom-Queries.fireeye"},
        {"name": "CheckPlease.fireeye"},
        {"name": "CredNinja.fireeye"},
        {"name": "DAMP.fireeye"},
+        {"name": "Dumpert.fireeye"},
        {"name": "contextmenu.fireeye"},
        {"name": "CrackMapExec.fireeye"},
        {"name": "CrackMapExecWin.fireeye"},
@@ -108,6 +131,7 @@
        {"name": "Exchange-AD-Privesc.fireeye"},
        {"name": "flare-floss.fireeye"},
        {"name": "fuzzdb.fireeye"},
+        {"name": "GadgetToJScript.fireeye"},
        {"name": "Generate-Macro.fireeye"},
        {"name": "Get-LAPSPasswords.fireeye"},
        {"name": "Get-ReconInfo.fireeye"},
@@ -140,12 +164,14 @@
        {"name": "metatwin.fireeye"},
        {"name": "Mimikatz.fireeye"},
        {"name": "mimikittenz.fireeye"},
+        {"name": "Net-GPPPassword.fireeye"},
        {"name": "NetshHelperBeacon.fireeye"},
        {"name": "nishang.fireeye"},
        {"name": "nps.fireeye"},
+        {"name": "OffensiveCSharp.fireeye"},
        {"name": "pafishmacro.fireeye"},
        {"name": "PayloadsAllTheThings.fireeye"},
-        {"name": "PoshC2.fireeye"},
+        {"name": "powercat.fireeye"},
        {"name": "PowerLessShell.fireeye"},
        {"name": "PowerLurk.fireeye"},
        {"name": "PowerPriv.fireeye"},
@@ -154,10 +180,13 @@
        {"name": "PowerSploit.fireeye"},
        {"name": "PowerUpSQL.fireeye"},
        {"name": "PowerView.fireeye"},
+        {"name": "Privesc.fireeye"},
        {"name": "PrivExchange.fireeye"},
        {"name": "PSAmsi.fireeye"},
        {"name": "PSAttack.fireeye"},
+        {"name": "PSBits.fireeye"},
        {"name": "PSReflect.fireeye"},
+        {"name": "Recon-AD.fireeye"},
        {"name": "RedTeamPowershellScripts.fireeye"},
        {"name": "RiskySPN.fireeye"},
        {"name": "Rubeus.fireeye"},
@@ -178,13 +207,14 @@
        {"name": "SpoolerScanner.fireeye"},
        {"name": "StarFighters.fireeye"},
        {"name": "SpoolSample.fireeye"},
+        {"name": "SysWhispers.fireeye"},
+        {"name": "ThreadContinue.fireeye"},
+        {"name": "TikiTorch.fireeye"},
        {"name": "UACME.fireeye"},
        {"name": "vssown.fireeye"},
        {"name": "WMImplant.fireeye"},
        {"name": "WMIOps.fireeye"},
        {"name": "zBang.fireeye"},
-        {"name": "Elite.fireeye"},
-        {"name": "covenant.fireeye"},
        {"name": "ad-control-paths.fireeye"},
        {"name": "defendercheck.fireeye"},
        {"name": "dnsrecon.fireeye"},
@@ -206,4 +236,4 @@
        {"name": "SharpSploit.fireeye"},
        {"name": "openvpn.fireeye", "args":"--parameters \'/SELECT_SHORTCUTS=0 /SELECT_LAUNCH=0\'"}
    ]
-}
+}
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
  <metadata>
    <id>commandovm.win10.preconfig.fireeye</id>
-    <version>2.0.0.0</version>
+    <version>2.0.0.1</version>
    <title>CommandoVM</title>
    <authors>Jake Barteaux</authors>
    <description>CommandoVM - Penetration Testing Distribution</description>
@@ -1,7 +1,7 @@
 ##########
 # Win 10 / Server 2016 / Server 2019 Initial Setup Script - Default preset
 # Author: Disassembler <[email protected]>
-# Version: v3.6, 2019-01-28
+# Version: v3.8, 2019-09-11
 # Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
 ##########

@@ -11,18 +11,22 @@ RequireAdmin
 ### Privacy Tweaks ###
 DisableTelemetry                # EnableTelemetry
 DisableWiFiSense                # EnableWiFiSense
-# DisableSmartScreen            # EnableSmartScreen
-DisableWebSearch                # EnableWebSearch
+DisableSmartScreen            # EnableSmartScreen
+DisableWebSearch              # EnableWebSearch
 DisableAppSuggestions           # EnableAppSuggestions
 DisableActivityHistory          # EnableActivityHistory
 DisableBackgroundApps           # EnableBackgroundApps
-DisableLocationTracking         # EnableLocationTracking
+# DisableSensors                # EnableSensors
+DisableLocation                 # EnableLocation
 DisableMapUpdates               # EnableMapUpdates
 DisableFeedback                 # EnableFeedback
 DisableTailoredExperiences      # EnableTailoredExperiences
 DisableAdvertisingID            # EnableAdvertisingID
 DisableWebLangList              # EnableWebLangList
 DisableCortana                  # EnableCortana
+# DisableBiometrics             # EnableBiometrics
+# DisableCamera                 # EnableCamera
+# DisableMicrophone             # EnableMicrophone
 DisableErrorReporting           # EnableErrorReporting
 # SetP2PUpdateLocal             # SetP2PUpdateInternet          # SetP2PUpdateDisable
 DisableDiagTrack                # EnableDiagTrack
@@ -31,41 +35,56 @@ DisableWAPPush                  # EnableWAPPush
 # DisableRecentFiles            # EnableRecentFiles

 ### Security Tweaks ###
-SetUACLow                       # SetUACHigh
+SetUACLow                     # SetUACHigh
 # EnableSharingMappedDrives     # DisableSharingMappedDrives
 DisableAdminShares              # EnableAdminShares
-DisableSMB1                   # EnableSMB1
-# DisableSMBServer              # EnableSMBServer
-DisableLLMNR                  # EnableLLMNR
-# DisableNCSIProbe              # EnableNCSIProbe
-SetCurrentNetworkPrivate        # SetCurrentNetworkPublic
-# SetUnknownNetworksPrivate     # SetUnknownNetworksPublic
-# DisableNetDevicesAutoInst     # EnableNetDevicesAutoInst
-# DisableFirewall               # EnableFirewall
+DisableFirewall               # EnableFirewall
 # HideDefenderTrayIcon          # ShowDefenderTrayIcon
 DisableDefender               # EnableDefender
 DisableDefenderCloud          # EnableDefenderCloud
 # EnableCtrldFolderAccess       # DisableCtrldFolderAccess
 # EnableCIMemoryIntegrity       # DisableCIMemoryIntegrity
-DisableDefenderAppGuard        # EnableDefenderAppGuard
+# EnableDefenderAppGuard        # DisableDefenderAppGuard
 HideAccountProtectionWarn       # ShowAccountProtectionWarn
 DisableDownloadBlocking       # EnableDownloadBlocking
-DisableScriptHost               # EnableScriptHost
+EnableScriptHost                # DisableScriptHost
 EnableDotNetStrongCrypto        # DisableDotNetStrongCrypto
 # EnableMeltdownCompatFlag      # DisableMeltdownCompatFlag
 EnableF8BootMenu                # DisableF8BootMenu
 # DisableBootRecovery           # EnableBootRecovery
 # DisableRecoveryAndReset       # EnableRecoveryAndReset
-# SetDEPOptOut                    # SetDEPOptIn
+SetDEPOptOut                    # SetDEPOptIn
+
+### Network Tweaks ###
+SetCurrentNetworkPrivate        # SetCurrentNetworkPublic
+SetUnknownNetworksPrivate     # SetUnknownNetworksPublic
+DisableNetDevicesAutoInst     # EnableNetDevicesAutoInst
+# DisableHomeGroups             # EnableHomeGroups
+EnableSMB1                      # DisableSMB1
+# DisableSMBServer              # EnableSMBServer
+# DisableNetBIOS                # EnableNetBIOS
+DisableLLMNR                  # EnableLLMNR
+# DisableLLDP                   # EnableLLDP
+# DisableLLTD                   # EnableLLTD
+# DisableMSNetClient            # EnableMSNetClient
+# DisableQoS                    # EnableQoS
+# DisableIPv4                   # EnableIPv4
+# DisableIPv6                   # EnableIPv6
+# DisableNCSIProbe              # EnableNCSIProbe
+# DisableConnectionSharing      # EnableConnectionSharing
+DisableRemoteAssistance         # EnableRemoteAssistance
+# EnableRemoteDesktop           # DisableRemoteDesktop

 ### Service Tweaks ###
-DisableUpdateMSRT             # EnableUpdateMSRT
+DisableUpdateMSRT               # EnableUpdateMSRT
 # DisableUpdateDriver           # EnableUpdateDriver
+EnableUpdateMSProducts          # DisableUpdateMSProducts
+DisableUpdateAutoDownload       # EnableUpdateAutoDownload
 DisableUpdateRestart            # EnableUpdateRestart
-# DisableHomeGroups             # EnableHomeGroups
+DisableMaintenanceWakeUp        # EnableMaintenanceWakeUp
+DisableAutoRestartSignOn        # EnableAutoRestartSignOn
 DisableSharedExperiences        # EnableSharedExperiences
-DisableRemoteAssistance         # EnableRemoteAssistance
-# EnableRemoteDesktop             # DisableRemoteDesktop
+# EnableClipboardHistory        # DisableClipboardHistory
 DisableAutoplay                 # EnableAutoplay
 DisableAutorun                  # EnableAutorun
 # DisableRestorePoints          # EnableRestorePoints
@@ -74,12 +93,14 @@ DisableAutorun                  # EnableAutorun
 # DisableSuperfetch             # EnableSuperfetch
 # DisableIndexing               # EnableIndexing
 # DisableSwapFile               # EnableSwapFile
+# DisableRecycleBin             # EnableRecycleBin
+EnableNTFSLongPaths             # DisableNTFSLongPaths
 # DisableNTFSLastAccess         # EnableNTFSLastAccess
 # SetBIOSTimeUTC                # SetBIOSTimeLocal
 # EnableHibernation             # DisableHibernation
 # DisableSleepButton            # EnableSleepButton
-# DisableSleepTimeout           # EnableSleepTimeout
-# DisableFastStartup            # EnableFastStartup
+DisableSleepTimeout             # EnableSleepTimeout
+EnableFastStartupp              # DisableFastStartup
 # DisableAutoRebootOnCrash      # EnableAutoRebootOnCrash

 ### UI Tweaks ###
@@ -87,18 +108,20 @@ DisableActionCenter             # EnableActionCenter
 DisableLockScreen               # EnableLockScreen
 # DisableLockScreenRS1          # EnableLockScreenRS1
 HideNetworkFromLockScreen       # ShowNetworkOnLockScreen
-HideShutdownFromLockScreen      # ShowShutdownOnLockScreen
+# HideShutdownFromLockScreen      # ShowShutdownOnLockScreen
+DisableLockScreenBlur           # EnableLockScreenBlur
 DisableAeroShake              # EnableAeroShake
-DisableStickyKeys               # EnableStickyKeys
+DisableAccessibilityKeys        # EnableAccessibilityKeys
 ShowTaskManagerDetails          # HideTaskManagerDetails
 ShowFileOperationsDetails       # HideFileOperationsDetails
 # EnableFileDeleteConfirm       # DisableFileDeleteConfirm
-# HideTaskbarSearch               # ShowTaskbarSearchIcon         # ShowTaskbarSearchBox
-# HideTaskView                    # ShowTaskView
+HideTaskbarSearch               # ShowTaskbarSearchIcon         # ShowTaskbarSearchBox
+ShowTaskView                    # HideTaskView
 # ShowSmallTaskbarIcons           # ShowLargeTaskbarIcons
-# SetTaskbarCombineWhenFull       # SetTaskbarCombineNever        # SetTaskbarCombineAlways
+SetTaskbarCombineWhenFull       # SetTaskbarCombineNever        # SetTaskbarCombineAlways
 HideTaskbarPeopleIcon           # ShowTaskbarPeopleIcon
 ShowTrayIcons                   # HideTrayIcons
+# ShowSecondsInTaskbar          # HideSecondsFromTaskbar
 # DisableSearchAppInStore         # EnableSearchAppInStore
 DisableNewAppPrompt             # EnableNewAppPrompt
 # HideRecentlyAddedApps         # ShowRecentlyAddedApps
@@ -110,43 +133,54 @@ SetVisualFXPerformance          # SetVisualFXAppearance
 # EnableTitleBarColor           # DisableTitleBarColor
 EnableDarkTheme               # DisableDarkTheme
 # AddENKeyboard                 # RemoveENKeyboard
-# EnableNumlock                 # DisableNumlock
+EnableNumlock                 # DisableNumlock
 # DisableEnhPointerPrecision    # EnableEnhPointerPrecision
 # SetSoundSchemeNone            # SetSoundSchemeDefault
 # DisableStartupSound           # EnableStartupSound
 # DisableChangingSoundScheme    # EnableChangingSoundScheme
+# EnableVerboseStatus           # DisableVerboseStatus
+DisableF1HelpKey                # EnableF1HelpKey

 ### Explorer UI Tweaks ###
+ShowExplorerTitleFullPath     # HideExplorerTitleFullPath
 ShowKnownExtensions             # HideKnownExtensions
 ShowHiddenFiles                 # HideHiddenFiles
+ShowSuperHiddenFiles          # HideSuperHiddenFiles
+ShowEmptyDrives               # HideEmptyDrives
+ShowFolderMergeConflicts      # HideFolderMergeConflicts
 EnableNavPaneExpand             # DisableNavPaneExpand
+ShowNavPaneAllFolders         # HideNavPaneAllFolders
 # EnableFldrSeparateProcess     # DisableFldrSeparateProcess
 # EnableRestoreFldrWindows      # DisableRestoreFldrWindows
+# ShowEncCompFilesColor         # HideEncCompFilesColor
 # DisableSharingWizard          # EnableSharingWizard
 # HideSelectCheckboxes          # ShowSelectCheckboxes
 HideSyncNotifications           # ShowSyncNotifications
 HideRecentShortcuts             # ShowRecentShortcuts
 SetExplorerThisPC               # SetExplorerQuickAccess
 HideQuickAccess                 # ShowQuickAccess
+# HideRecycleBinFromDesktop     # ShowRecycleBinOnDesktop
 ShowThisPCOnDesktop             # HideThisPCFromDesktop
 # ShowUserFolderOnDesktop       # HideUserFolderFromDesktop
 # ShowControlPanelOnDesktop     # HideControlPanelFromDesktop
-HideDesktopFromThisPC           # ShowDesktopInThisPC
+# ShowNetworkOnDesktop          # HideNetworkFromDesktop
+# ShowBuildNumberOnDesktop      # HideBuildNumberFromDesktop
+# HideDesktopFromThisPC           # ShowDesktopInThisPC
 # HideDesktopFromExplorer       # ShowDesktopInExplorer
 # HideDocumentsFromThisPC         # ShowDocumentsInThisPC
 # HideDocumentsFromExplorer     # ShowDocumentsInExplorer
 # HideDownloadsFromThisPC         # ShowDownloadsInThisPC
 # HideDownloadsFromExplorer     # ShowDownloadsInExplorer
 HideMusicFromThisPC             # ShowMusicInThisPC
-# HideMusicFromExplorer         # ShowMusicInExplorer
+HideMusicFromExplorer         # ShowMusicInExplorer
 HidePicturesFromThisPC          # ShowPicturesInThisPC
-# HidePicturesFromExplorer      # ShowPicturesInExplorer
+HidePicturesFromExplorer      # ShowPicturesInExplorer
 HideVideosFromThisPC            # ShowVideosInThisPC
-# HideVideosFromExplorer        # ShowVideosInExplorer
+HideVideosFromExplorer        # ShowVideosInExplorer
 Hide3DObjectsFromThisPC         # Show3DObjectsInThisPC
-# Hide3DObjectsFromExplorer     # Show3DObjectsInExplorer
-# HideIncludeInLibraryMenu      # ShowIncludeInLibraryMenu
-# HideGiveAccessToMenu          # ShowGiveAccessToMenu
+Hide3DObjectsFromExplorer     # Show3DObjectsInExplorer
+HideIncludeInLibraryMenu      # ShowIncludeInLibraryMenu
+HideGiveAccessToMenu          # ShowGiveAccessToMenu
 # HideShareMenu                 # ShowShareMenu
 # DisableThumbnails             # EnableThumbnails
 DisableThumbnailCache           # EnableThumbnailCache
@@ -159,23 +193,29 @@ UninstallMsftBloat              # InstallMsftBloat
 UninstallThirdPartyBloat        # InstallThirdPartyBloat
 # UninstallWindowsStore         # InstallWindowsStore
 DisableXboxFeatures             # EnableXboxFeatures
+# DisableFullscreenOptims       # EnableFullscreenOptims
 DisableAdobeFlash               # EnableAdobeFlash
 DisableEdgePreload              # EnableEdgePreload
 DisableEdgeShortcutCreation     # EnableEdgeShortcutCreation
 DisableIEFirstRun               # EnableIEFirstRun
+DisableFirstLogonAnimation      # EnableFirstLogonAnimation
+DisableMediaSharing             # EnableMediaSharing
+EnableDeveloperMode           # DisableDeveloperMode
 # UninstallMediaPlayer          # InstallMediaPlayer
 # UninstallInternetExplorer     # InstallInternetExplorer
 # UninstallWorkFolders          # InstallWorkFolders
 # UninstallPowerShellV2         # InstallPowerShellV2
 InstallLinuxSubsystem         # UninstallLinuxSubsystem
 InstallHyperV                 # UninstallHyperV
+# UninstallSSHClient            # InstallSSHClient
+# InstallSSHServer              # UninstallSSHServer
 # InstallNET23                  # UninstallNET23
 SetPhotoViewerAssociation       # UnsetPhotoViewerAssociation
 AddPhotoViewerOpenWith          # RemovePhotoViewerOpenWith
 # UninstallPDFPrinter           # InstallPDFPrinter
 UninstallXPSPrinter             # InstallXPSPrinter
 RemoveFaxPrinter                # AddFaxPrinter
-UninstallFaxAndScan           # InstallFaxAndScan
+# UninstallFaxAndScan           # InstallFaxAndScan

 ### Server Specific Tweaks ###
 # HideServerManagerOnLogin      # ShowServerManagerOnLogin
@@ -45,7 +45,7 @@ The script supports command line options and parameters which can help you custo
 **Q:** Did you test the script?  
 **A:** Yes. I'm testing new additions on up-to-date 64bit Home and Enterprise editions in VMs. I'm also regularly using it for all my home installations after all bigger updates.

-**Q**: I've run the script and it did something I don't like, how can I undo it?  
+**Q:** I've run the script and it did something I don't like, how can I undo it?  
 **A:** For every tweak, there is also a corresponding function which restores the default settings. The default is considered freshly installed Windows 10 or Windows Server 2016 with no adjustments made during or after the installation. Use the tweaks to create and run new preset. Alternatively, since some functions are just automation for actions which can be done using GUI, find appropriate control and modify it manually.

 **Q:** I've run the script and some controls are now greyed out and display message "*Some settings are hidden or managed by your organization*", why?  
@@ -82,15 +82,18 @@ The script supports command line options and parameters which can help you custo
 |  1709   | Redstone 3 (RS3)        | Fall Creators Update   | 16299 |
 |  1803   | Redstone 4 (RS4)        | April 2018 Update      | 17134 |
 |  1809   | Redstone 5 (RS5)        | October 2018 Update    | 17763 |
+|  1903   | 19H1                    | May 2019 Update        | 18362 |
+|  1909   | 19H2                    | November 2019 Update   | 18363 |

 &nbsp;

 ## Advanced usage

-    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 [-include filename] [-preset filename] [[!]tweakname]
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 [-include filename] [-preset filename] [-log logname] [[!]tweakname]

    -include filename       load module with user-defined tweaks
    -preset filename        load preset with tweak names to apply
+    -log logname            save script output to a file
    tweakname               apply tweak with this particular name
    !tweakname              remove tweak with this particular name from selection

@@ -156,6 +159,14 @@ Command using all three examples combined:

 &nbsp;

+### Logging
+
+If you'd like to store output from the script execution, you can do so using `-log` parameter followed by a filename of the log file you want to create. For example:
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 -include Win10.psm1 -preset mypreset.txt -log myoutput.log
+
+The logging is done using PowerShell `Start-Transcript` cmdlet, which writes extra information about current environment (date, machine and user name, command used for execution etc.) to the beginning of the file and logs both standard output and standard error streams.
+
 ## Maintaining own forks

 The easiest way to customize the script settings it is to create your own preset and, if needed, your own tweak scripts as described above. For easy start, you can base the modifications on the *Default.cmd* and *Default.preset* and maintain just that. If you choose to fork the script anyway, you don't need to comment or remove the actual functions in *Win10.psm1*, because if they are not called, they are not used.
@@ -1,7 +1,7 @@
 ##########
 # Win 10 / Server 2016 / Server 2019 Initial Setup Script - Main execution loop
 # Author: Disassembler <[email protected]>
-# Version: v3.6, 2019-01-28
+# Version: v3.8, 2019-09-11
 # Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
 ##########

@@ -31,16 +31,22 @@ $i = 0
 While ($i -lt $args.Length) {
 	If ($args[$i].ToLower() -eq "-include") {
 		# Resolve full path to the included file
-		$include = Resolve-Path $args[++$i]
+		$include = Resolve-Path $args[++$i] -ErrorAction Stop
 		$PSCommandArgs += "-include `"$include`""
 		# Import the included file as a module
-		Import-Module -Name $include
+		Import-Module -Name $include -ErrorAction Stop
 	} ElseIf ($args[$i].ToLower() -eq "-preset") {
 		# Resolve full path to the preset file
-		$preset = Resolve-Path $args[++$i]
+		$preset = Resolve-Path $args[++$i] -ErrorAction Stop
 		$PSCommandArgs += "-preset `"$preset`""
 		# Load tweak names from the preset file
 		Get-Content $preset -ErrorAction Stop | ForEach-Object { AddOrRemoveTweak($_.Split("#")[0].Trim()) }
+	} ElseIf ($args[$i].ToLower() -eq "-log") {
+		# Resolve full path to the output file
+		$log = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($args[++$i])
+		$PSCommandArgs += "-log `"$log`""
+		# Record session to the output file
+		Start-Transcript $log
 	} Else {
 		$PSCommandArgs += $args[$i]
 		# Load tweak names from command line
@@ -5,15 +5,38 @@
 # To execute this script:
 # 1) Open powershell window as administrator
 # 2) Allow script execution by running command "Set-ExecutionPolicy Unrestricted"
-# 3) Execute the script by running ".\install.ps1"
+# 3) Unblock the install script by running "Unblock-File .\install.ps1"
+# 4) Execute the script by running ".\install.ps1"
 #
 ###########################################
 param (
  [string]$password = "",  
-	[string]$profile_file = $null, 
+  [string]$profile_file = $null, 
  [bool]$nochecks = $false
 )

+
+function Set-EnvironmentVariableWrap([string] $key, [string] $value)
+{
+<#
+.SYNOPSIS
+	Set the environment variable for all process, user and system wide scopes
+.OUTPUTS
+	True on success | False on error
+#>
+  try {
+	  [Environment]::SetEnvironmentVariable($key, $value)
+	  [Environment]::SetEnvironmentVariable($key, $value, 1)
+	  [Environment]::SetEnvironmentVariable($key, $value, 2)
+	
+	  $rc = $true
+	} catch {
+		$rc = $false
+	}
+	$rc
+}
+
+
 function ConvertFrom-Json([object] $item) {
 <#
 .SYNOPSIS
@@ -103,9 +126,13 @@ function Make-InstallerPackage($PackageName, $TemplateDir, $packages) {
 	Write-Host -ForegroundColor Green "packages file is" + $tmp
 	ConvertTo-Json @{"packages" = $packages} | Out-File -FilePath $Tmp
 	
-	$Here = Get-Location
-	$ToolsDir = Join-Path (Join-Path $Here $TemplateDir) "tools"
-	$Dest = Join-Path $ToolsDir "packages.json"
+  if ([System.IO.Path]::IsPathRooted($TemplateDir)) {
+    $ToolsDir = Join-Path $TemplateDir "tools"
+  } else {
+	  $Here = Get-Location
+	  $ToolsDir = Join-Path (Join-Path $Here $TemplateDir) "tools"
+  }
+  $Dest = Join-Path $ToolsDir "packages.json"

 	Move-Item -Force -Path $Tmp -Destination $Dest
 	New-BoxstarterPackage -Name $PackageName -Description "My Own Instalelr" -Path $ToolsDir
@@ -161,7 +188,7 @@ function installBoxStarter()
  }  
  $prevSecProtocol = [System.Net.ServicePointManager]::SecurityProtocol
  $prevCertPolicy = [System.Net.ServicePointManager]::CertificatePolicy  
-  Write-Host "[ * ] Installing Boxstarter"
+  Write-Host "[+] Installing Boxstarter"
  # Become overly trusting
  [System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
  [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy  
@@ -173,7 +200,18 @@ function installBoxStarter()
  [System.Net.ServicePointManager]::CertificatePolicy = $prevCertPolicy
  return $true
 }
-Write-Host "[+] Beginning install..."
+function Wait-ForInstall ($seconds) {
+  $doneDT = (Get-Date).AddSeconds($seconds)
+  while($doneDT -gt (Get-Date)) {
+      $secondsLeft = $doneDT.Subtract((Get-Date)).TotalSeconds
+      $percent = ($seconds - $secondsLeft) / $seconds * 100
+      Write-Progress -Activity "Please read install notes on console below" -Status "Beginning install in..." -SecondsRemaining $secondsLeft -PercentComplete $percent
+      [System.Threading.Thread]::Sleep(500)
+  }
+  Write-Progress -Activity "Waiting" -Status "Beginning install..." -SecondsRemaining 0 -Completed
+}
+
+Write-Host "`n"
 Write-Host " ____________________________________________________________________________ " -ForegroundColor Red 
 Write-Host "|                                                                            |" -ForegroundColor Red 
 Write-Host "|    "  -ForegroundColor Red -NoNewline; Write-Host "                  " -ForegroundColor Green -NoNewline; Write-Host "                                                      |" -ForegroundColor Red 
@@ -186,19 +224,19 @@ Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "        \/
 Write-Host "|                       C O M P L E T E  M A N D I A N T                     |" -ForegroundColor Red 
 Write-Host "|                            O F F E N S I V E   V M                         |" -ForegroundColor Red 
 Write-Host "|                                                                            |" -ForegroundColor Red 
-Write-Host "|                                  Version 2.0                               |" -ForegroundColor Red 
+Write-Host "|                                 Version 2020.1                             |" -ForegroundColor Red 
 Write-Host "|                             [email protected]                         |" -ForegroundColor Red 
 Write-Host "|____________________________________________________________________________|" -ForegroundColor Red 
 Write-Host "|                                                                            |" -ForegroundColor Red 
-Write-Host "|                                  Developed by                              |" -ForegroundColor Red 
-Write-Host "|                                  Jake Barteaux                             |" -ForegroundColor Red 
-Write-Host "|                                Mandiant Red Team                           |" -ForegroundColor Red 
-Write-Host "|                                 Blaine Stancill                            |" -ForegroundColor Red 
+Write-Host "|                                   Created by                               |" -ForegroundColor Red 
+Write-Host "|                            Jake Barteaux @day1player                       |" -ForegroundColor Red 
+Write-Host "|                               Proactive Services                           |" -ForegroundColor Red 
+Write-Host "|                         Blaine Stancill @MalwareMechanic                   |" -ForegroundColor Red 
 Write-Host "|                                   Nhan Huynh                               |" -ForegroundColor Red 
 Write-Host "|                    FireEye Labs Advanced Reverse Engineering               |" -ForegroundColor Red 
 Write-Host "|____________________________________________________________________________|" -ForegroundColor Red 
 Write-Host ""
-
+  
 if ([string]::IsNullOrEmpty($profile_file)) {
  Write-Host "[+] No custom profile is provided..."
  $profile = $null
@@ -210,10 +248,8 @@ if ([string]::IsNullOrEmpty($profile_file)) {
    exit 1
  }
  # Confirmation message
-  $TemplateDir = $profile.env.TEMPLATE_DIR
-  $Packages = $profile.packages
-  Write-Warning "[+] You are using a custom profile and list of packages. You will NOT receive updates"
-  Write-Warning "[+] on new packages from Commando VM automatically when running choco update."
+  Write-Warning "[+] You are using a custom profile and list of packages,"
+  Write-Warning "[+] You will NOT receive new tools automatically when running choco update."

  if ($nochecks -eq $false) {
    Write-Host "[-] Do you want to continue? Y/N " -ForegroundColor Yellow -NoNewline
@@ -221,10 +257,9 @@ if ([string]::IsNullOrEmpty($profile_file)) {
    if ($response -ne "Y") {
      Write-Host "[*] Exiting..." -ForegroundColor Red
      exit
+    }
  }
-}
-
-Write-Host "`tContinuing..." -ForegroundColor Green
+  Write-Host "`tContinuing..." -ForegroundColor Green
 }


@@ -233,23 +268,19 @@ Write-Host "[+] Checking if script is running as administrator.."
 $currentPrincipal = New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent() )
 if (-Not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
  Write-Host "`t[ERR] Please run this script as administrator`n" -ForegroundColor Red
+  Write-Host "`n`t`tthis is not the way`n" -ForegroundColor Red
  Read-Host  "Press any key to continue"
  exit
-}
-else {
+} else {
  Start-Sleep -Milliseconds 500
-  Write-Host "`tphenomenal " -ForegroundColor Magenta -NoNewLine
-  Start-Sleep -Milliseconds 500
-  Write-Host "cosmic " -ForegroundColor Cyan -NoNewLine
-  Start-Sleep -Milliseconds 500
-  Write-Host "powers " -ForegroundColor Green
+  Write-Host "`tthis is the way" -ForegroundColor Cyan
  Start-Sleep -Milliseconds 500
 }

 if ($nochecks -eq $false) {
  
  # Check to make sure Tamper Protection is off
-  # This setting is not able to be changed via command line
+  # This setting is not able to be changed via command line or via scripts
  Write-Host "[+] Checking to make sure Windows Defender Tamper Protection is disabled"
  if (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection") {
    if ($(Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -Name "TamperProtection").TamperProtection -ne 0){
@@ -263,31 +294,66 @@ if ($nochecks -eq $false) {
    }
      Write-Host "`tContinuing..." -ForegroundColor Green
    }
-  }
-  else {
+  } else {
    Write-Host "`tTamper Protection is off, looks good." -ForegroundColor Green
  }
  
  # Check to make sure host is supported
  Write-Host "[+] Checking to make sure Operating System is compatible"
-  if (-Not (((Get-WmiObject -class Win32_OperatingSystem).Version -eq "6.1.7601") -or ([System.Environment]::OSVersion.Version.Major -eq 10))){
-    Write-Host "`t[ERR] $((Get-WmiObject -class Win32_OperatingSystem).Caption) is not supported, please use Windows 7 Service Pack 1 or Windows 10" -ForegroundColor Red
-    exit 
+  if ((Get-WmiObject -class Win32_OperatingSystem).Version -eq "6.1.7601"){
+    Write-Host "Windows 7 is no longer supported. Do you want to continue install? Y/N" -ForegroundColor Yellow
+    $response = Read-Host
+    if ($response -ne "Y"){
+      exit
+    }
  }
-  else
-  {
-    Write-Host "`t$((Get-WmiObject -class Win32_OperatingSystem).Caption) supported" -ForegroundColor Green
+  
+  ## Windows 10 Versions/Build Numbers
+  # https://github.com/Disassembler0/Win10-Initial-Setup-Script
+  # 1909 (November 2019 Update)	18363
+  # 1903 (May 2019 Update)    	18362
+  # 1809 (October 2018 Update)	17763
+  # 1803 (April 2018 Update)   	17134
+
+  $osversion = (Get-WmiObject -class Win32_OperatingSystem).BuildNumber
+  if (-Not (($osversion -eq 18363) -or ($osversion -eq 18361) -or ($osversion -eq 17763) -or ($osversion -eq 17134) )){
+    Write-Host "`t[ERR] Windows version $osversion is not has not been tested, please use Windows 10 version 1803, 1809, 1903 or 1909." -ForegroundColor Yellow
+    Write-Host "`t      Do you still wish to proceed? Y/N" -ForegroundColor Yellow
+    $response = Read-Host 
+    if ($response -ne "Y"){
+      exit
+    }
+  } else {
+    Write-Host "`tWindows build $osversion supported." -ForegroundColor Green
  }

  # Check to make sure host has been updated
  Write-Host "[+] Checking if host has been configured with updates"
  if (-Not (get-hotfix | where { (Get-Date($_.InstalledOn)) -gt (get-date).adddays(-30) })) {
-    Write-Host "`t[ERR] This machine has not been updated in the last 30 days, please run Windows Updates to continue`n" -ForegroundColor Red
-    Read-Host  "Press any key to continue"
-    exit
-  }
-  else
-  {
+    try 
+    {
+      Write-Host "`t[ERR] This machine has not been updated in the last 30 days, do you want to try installing updates automatically? Y/N " -ForegroundColor Yellow -NoNewline
+      $response = Read-Host
+      if ($response -eq "Y"){
+        Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
+        Install-Module PSWindowsUpdate -Force
+        Import-Module PSWindowsUpdate
+        Get-WindowsUpdate
+        Install-WindowsUpdate -AcceptAll -IgnoreReboot -IgnoreRebootRequired
+      } else {
+        Write-Host "Please install updates manually." -ForegroundColor Red
+        exit
+      }
+    }
+    catch 
+    {
+      Write-Host "`t[ERR] Could not update automatically, please run Windows Updates manually to continue`n" -ForegroundColor Red
+      Read-Host  "Press any key to exit"
+      exit
+      
+    }
+    
+  } else {
 	  Write-Host "`tupdates appear to be in order" -ForegroundColor Green
  }

@@ -299,9 +365,7 @@ if ($nochecks -eq $false) {
    Write-Host "`t[ERR] This install requires a minimum 60 GB hard drive, please increase hard drive space to continue`n" -ForegroundColor Red
    Read-Host "Press any key to continue"
    exit
-  }
-  else
-  {
+  } else {
    Write-Host "`t> 60 GB hard drive. looks good" -ForegroundColor Green
  }

@@ -309,14 +373,14 @@ if ($nochecks -eq $false) {
  Write-Host "[-] Do you need to take a snapshot before continuing? Y/N " -ForegroundColor Yellow -NoNewline
  $response = Read-Host
  if ($response -ne "N") {
-    Write-Host "[ * ] Exiting..." -ForegroundColor Red
+    Write-Host "[+] Exiting..." -ForegroundColor Red
    exit
  }
  Write-Host "`tContinuing..." -ForegroundColor Green
 }

 # Get user credentials for autologin during reboots
-Write-Host "[ * ] Getting user credentials ..."
+Write-Host "[+] Getting user credentials ..."
 Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds" -Name "ConsolePrompting" -Value $True
 if ([string]::IsNullOrEmpty($password)) {
 	$cred=Get-Credential $env:username
@@ -325,7 +389,37 @@ if ([string]::IsNullOrEmpty($password)) {
 	$cred=New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $env:username, $spasswd
 }

-Write-Host "[ * ] Installing Boxstarter"
+if ($nochecks -eq $false){
+  Write-Host @"
+
+[!] INSTALL NOTES [!]
+
+- This install is not 100% unattended. Please monitor the install for possible failures. If install
+fails you may restart the install by re-running the install script with the following command:
+
+      .\install.ps1 -nochecks 1 [<password>]
+
+
+- Install is not complete until the desktop is cleaned, the readme is placed on the desktop, and the
+desktop background is set with the Commando VM logo. 
+
+- You can check what packages failed install by listing the C:\ProgramData\chocolatey\lib-bad 
+directory. Failed packages are stored by folder name. You can attempt manual install with the 
+following command:
+
+      cinst -y <package name>
+
+
+- For any issues please submit to GitHub or reach out to commandovm@fireeye.com
+
+[!] Please copy these notes for reference [!]
+"@ -ForegroundColor Yellow
+  Wait-ForInstall -seconds 60
+}
+
+Write-Host "`n[+] Beginning Install...`n" -ForegroundColor Green
+
+Write-Host "[+] Installing Boxstarter"
 $rc = installBoxStarter
 if ( -Not $rc ) {
 	Write-Host "[ERR] Failed to install BoxStarter"
@@ -351,7 +445,7 @@ iex "refreshenv"
 if ($profile -eq $null) {
  # Default install
  Write-Host "[+] Performing normal installation..."
-  iex "choco upgrade -y common.fireeye"
+  choco upgrade -y common.fireeye
  if ([System.Environment]::OSVersion.Version.Major -eq 6) {
    Install-BoxstarterPackage -PackageName commandovm.win7.installer.fireeye -Credential $cred
    Install-BoxStarterPackage -PackageName commandovm.win7.config.fireeye  -Credential $cred
@@ -374,25 +468,26 @@ $EnvVars = @(

 foreach ($envVar in $EnvVars) {
  try {
-    [Environment]::SetEnvironmentVariable($envVar, [Environment]::ExpandEnvironmentVariables($profile.env.($envVar)), 2)
+		$value = [Environment]::ExpandEnvironmentVariables($profile.env.($envVar))
+		if (-Not (Set-EnvironmentVariableWrap $envVar $value)) {
+			Write-Warning "[ - ] Failed to set environment variable $envVar"
+		}
  } catch {}
 }

-if ([System.Environment]::OSVersion.Version.Major -eq 10) {
-  choco config set cacheLocation ${Env:TEMP}
-  iex "choco upgrade -y commandovm.win10.preconfig.fireeye"
-}
-
-iex "choco install -y common.fireeye"
+choco install -y common.fireeye
 refreshenv

 $PackageName = "MyInstaller"
+$TemplateDir = $profile.env.TEMPLATE_DIR
+$Packages = $profile.packages
 Make-InstallerPackage $PackageName $TemplateDir $Packages
 Invoke-BoxStarterBuild $PackageName
 Install-BoxStarterPackage -PackageName $PackageName -Credential $cred
 if ([System.Environment]::OSVersion.Version.Major -eq 6) {
  Install-BoxStarterPackage -PackageName commandovm.win7.config.fireeye  -Credential $cred
 } elseif ([System.Environment]::OSVersion.Version.Major -eq 10) {
+  iex "choco upgrade -y commandovm.win10.preconfig.fireeye"
  Install-BoxStarterPackage -PackageName commandovm.win10.config.fireeye  -Credential $cred
 }
 exit 0
@@ -14,8 +14,10 @@ apimonitor.flare,Allows creation of process traces that include all windows APIs
 apktool.flare,A tool for reverse engineering  Android apps, common.fireeye - https://chocolatey.org/packages//apktool, Android, https://ibotpeaches.github.io/Apktool/, cinst -y apktool.flare
 ASREPRoast.fireeye,Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled., , Password Attacks,https://github.com/HarmJ0y/ASREPRoast, cinst -y ASREPRoast.fireeye
 autoit.fireeye,Creates a shortcut in the Utilities folder, common.fireeye - https://chocolatey.org/packages//autoit, Utilities, http://www.autoitscript.com/autoit3, cinst -y autoit.fireeye
+BeRoot.fireeye,Privilege�Escalation�Project�-�Windows�/�Linux�/�Mac,,Exploitation,https://github.com/AlessandroZ/BeRoot,cinst -y beroot.fireeye
 binaryninja.flare,A dissassembler for reverse engineers, , Disassemblers, https://binary.ninja/demo.html, cinst -y binaryninja.flare
 BloodHound.fireeye,BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment., , Information Gathering,https://github.com/BloodHoundAD/BloodHound, cinst -y BloodHound.fireeye
+BloodHound-Custom-Queries.fireeye,https://hausec.com/2019/09/09/bloodhound-cypher-cheatsheet/,common.fireeye,Information Gathering,https://github.com/hausec/Bloodhound-Custom-Queries,cinst -y Custom-BloodHound-Queries.fireeye
 burp.free.fireeye,Creates a shortcut in the Web Application directory for BurpSuite Free Edition, common.fireeye - https://chocolatey.org/packages//burp-suite-free-edition, Web Application, https://portswigger.net/burp, cinst -y burp.free.fireeye
 burp.free.flare,Creates a shortcut in the Web Application directory for BurpSuite Free Edition, common.fireeye - https://chocolatey.org/packages//burp-suite-free-edition, Web Application, https://portswigger.net/burp, cinst -y burp.free.flare
 bytecode-viewer.flare,A Java 8+ Jar & Android APK Reverse Engineering Suite, common.fireeye - https://chocolatey.org/packages//javaruntime, Java, https://bytecodeviewer.com/, cinst -y bytecode-viewer.flare
@@ -26,7 +28,6 @@ cmder.fireeye,Creates a shortcut in the Utilities directory - pins cmder to task
 cmdermini.flare,Creates a shortcut in the Utilities directory - pins cmder to taskbar - and changes default ls alias to deconflict with unxUtils package, common.fireeye - https://chocolatey.org/packages//cmdermini, Utilities, http://cmder.net/, cinst -y cmdermini.flare
 common.fireeye,Fire Eye common shared library, , Utilities, , cinst -y common.fireeye
 contextmenu.fireeye,Creates `Open command window here as admin` and `Open PowerShell window here as admin` context menu items, , Utilities,, cinst -y contextmenu.fireeye
-Covenant.fireeye,Covenant is a .NET command and control framework, common.fireeye - https://chocolatey.org/packages//dotnetcore-sdk - Rubeus.fireeye - SharpSploit.fireeye - SharpDPAPI.fireeye - SharpUp.fireeye - Seatbelt.fireeye - SharpDump.fireeye - SharpWMI.fireeye, Command and Control,https://github.com/cobbr/Covenant, cinst -y Covenant.fireeye
 CrackMapExec.fireeye,A swiss army knife for pentesting networks, , Utilities,https://github.com/byt3bl33d3r/CrackMapExec, cinst -y CrackMapExec.fireeye
 CrackMapExecWin.fireeye,The great CrackMapExec tool compiled for Windows, , Exploitation,https://github.com/maaaaz/CrackMapExecWin, cinst -y CrackMapExecWin.fireeye
 CredNinja.fireeye,A multithreaded tool designed to identify if credentials are valid invalid or local admin valid credentials within a network at-scale via SMB, common.fireeye - https://chocolatey.org/packages//python3, Password Attacks,https://github.com/Raikia/CredNinja, cinst -y CredNinja.fireeye
@@ -47,8 +48,8 @@ DomainPasswordSpray.fireeye,DomainPasswordSpray is a tool written in PowerShell
 DotNetToJScript.fireeye,A tool to create a JScript file which loads a .NET v2 assembly from memory., , Evasion,https://github.com/tyranid/DotNetToJScript, cinst -y DotNetToJScript.fireeye
 dotPeek.flare,.NET decompiler, common.fireeye - https://chocolatey.org/packages//dotPeek, dotNET, http://www.jetbrains.com/decompiler, cinst -y dotPeek.flare
 DSInternals.fireeye,Directory Services Internals (DSInternals) PowerShell Module and Framework, , Password Attacks,https://github.com/MichaelGrafnetter/DSInternals, cinst -y DSInternals.fireeye
+Dumpert.fireeye,LSASS�memory�dumper�using�direct�system�calls�and�API�unhooking.,common.fireeye,Exploitation,https://github.com/outflanknl/Dumpert,cinst -y Dumpert.fireeye
 Egress-Assess.fireeye,Egress-Assess is a tool used to test egress data detection capabilities, common.fireeye - https://chocolatey.org/packages//python2 - libraries.python2.fireeye, Vulnerability,https://github.com/FortyNorthSecurity/Egress-Assess, cinst -y Egress-Assess.fireeye
-Elite.fireeye,Elite is the client-side component of the Covenant project., common.fireeye - https://chocolatey.org/packages//dotnetcore-sdk - Covenant.fireeye, Command and Control,https://github.com/cobbr/Elite, cinst -y Elite.fireeye
 EvilClippy.fireeye,A cross-platform assistant for creating malicious MS Office documents., , Exploitation,https://github.com/outflanknl/EvilClippy, cinst -y EvilClippy.fireeye
 Exchange-AD-Privesc.fireeye,Exchange privilege escalations to Active Directory, , Exploitation,https://github.com/gdedrouas/Exchange-AD-Privesc, cinst -y Exchange-AD-Privesc.fireeye
 exe2aut.fireeye,AutoIt decompiler, , Utilities, https://exe2aut.com/, cinst -y exe2aut.fireeye
@@ -66,22 +67,25 @@ flare-qdb.python.flare,FLARE QDB, common.fireeye - https://chocolatey.org/packag
 floss.python.flare,Fire Eye Labs Obfuscated String Solver, common.fireeye - https://chocolatey.org/packages//python2 - https://chocolatey.org/packages//vcpython27 - libraries.python2.fireeye, Utilities, https://github.com/fireeye/flare-floss, cinst -y floss.python.flare
 FOCA.fireeye,Tool to find metadata and hidden information in the documents., , Information Gathering,https://github.com/ElevenPaths/FOCA, cinst -y FOCA.fireeye
 fuzzdb.fireeye,Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery., , Wordlists,https://github.com/fuzzdb-project/fuzzdb, cinst -y fuzzdb.fireeye
-Generate-Macro.fireeye,This Powershell script will generate a malicious Microsoft Office document with a specified payload and persistence method., , Exploitation,https://github.com/enigma0x3/Generate-Macro, cinst -y Generate-Macro.fireeye
-Get-LAPSPasswords.fireeye,"Powershell function to pull the local admin passwords from LDAP, stored there by LAPS.", , Password Attacks,https://github.com/kfosaaen/Get-LAPSPasswords, cinst -y Get-LAPSPasswords.fireeye
-Get-ReconInfo.fireeye,A powershell script that prints a lot of IP and connection info to the screen, , Information Gathering,https://github.com/Raikia/Get-ReconInfo, cinst -y Get-ReconInfo.fireeye
+GadgetToJScript.fireeye,A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.,common.fireeye,Exploitation,https://github.com/med0x2e/GadgetToJScript,cinst -y Gadget2JScript.fireeye
+Generate-Macro.fireeye,This Powershell script will generate a malicious Microsoft Office document with a specified payload and persistence method.,common.fireeye, Exploitation,https://github.com/enigma0x3/Generate-Macro, cinst -y Generate-Macro.fireeye
+Get-LAPSPasswords.fireeye,"Powershell function to pull the local admin passwords from LDAP, stored there by LAPS.",common.fireeye, Password Attacks,https://github.com/kfosaaen/Get-LAPSPasswords, cinst -y Get-LAPSPasswords.fireeye
+Get-ReconInfo.fireeye,A powershell script that prints a lot of IP and connection info to the screen,common.fireeye, Information Gathering,https://github.com/Raikia/Get-ReconInfo, cinst -y Get-ReconInfo.fireeye
 ghidra.fireeye,An open sourced disassembler, common.fireeye - https://chocolatey.org/packages//openjdk11, Disassemblers, https://www.ghidra-sre.org/, cinst -y ghidra.fireeye
 gimp.fireeye,Creates a shortcut in the Utilities folder, common.fireeye - https://chocolatey.org/packages//gimp, Utilities, https://www.gimp.org/, cinst -y gimp.fireeye
-GoBuster.fireeye,"Directory/File, DNS and VHost busting tool written in Go", , Information Gathering,https://github.com/OJ/gobuster, cinst -y GoBuster.fireeye
-GoFetch.fireeye,GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application., , Exploitation,https://github.com/GoFetchAD/GoFetch/, cinst -y GoFetch.fireeye
+GoBuster.fireeye,"Directory/File, DNS and VHost busting tool written in Go",common.fireeye, Information Gathering,https://github.com/OJ/gobuster, cinst -y GoBuster.fireeye
+GoFetch.fireeye,GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application.,common.fireeye, Exploitation,https://github.com/GoFetchAD/GoFetch/, cinst -y GoFetch.fireeye
 googlechrome.fireeye,Google chrome, common.fireeye - https://chocolatey.org/packages//googlechrome, Web Application, https://www.google.com/chrome/browser/, cinst -y googlechrome.fireeye
 googlechrome.flare,Google chrome, common.fireeye - https://chocolatey.org/packages//googlechrome, Utilities, https://www.google.com/chrome/, cinst -y googlechrome.flare
-gowitness.fireeye,"A golang, web screenshot utility using Chrome Headless", , Information Gathering,https://github.com/sensepost/gowitness, cinst -y gowitness.fireeye
+gowitness.fireeye,"A golang, web screenshot utility using Chrome Headless",common.fireeye, Information Gathering,https://github.com/sensepost/gowitness, cinst -y gowitness.fireeye
 Greenshot.fireeye,Creates a Greenshot shortcut in the Utilities folder and disables auto start for Greenshot, common.fireeye - https://chocolatey.org/packages//greenshot, Utilities, http://getgreenshot.org/, cinst -y Greenshot.fireeye
-Grouper2.fireeye,Find vulnerabilities in AD Group Policy, , Vulnerability Analysis,https://github.com/l0ss/Grouper2, cinst -y Grouper2.fireeye
-hashcalc.flare,Hash calculator, , Utilities, http://www.slavasoft.com/hashcalc/index.htm, cinst -y hashcalc.flare
+Grouper2.fireeye,Find vulnerabilities in AD Group Policy,common.fireeye, Vulnerability Analysis,https://github.com/l0ss/Grouper2, cinst -y Grouper2.fireeye
+hashcalc.flare,Hash calculator,common.fireeye, Utilities, http://www.slavasoft.com/hashcalc/index.htm, cinst -y hashcalc.flare
 hashcat.fireeye,Password cracking utility, common.fireeye - https://chocolatey.org/packages//opencl-intel-cpu-runtime, Password Attacks,https://hashcat.net/hashcat/, cinst -y hashcat.fireeye
 hashmyfiles.flare,Hash calculator, , Utilities, https://www.nirsoft.net/utils/hash_my_files.html, cinst -y hashmyfiles.flare
+HeidiSQL.fireeye,"Interface for MySQL, MSSQL, and PostgreSQL",common.fireeye - https://chocolatey.org/packages/HeidiSQL,Utilities,https://chocolatey.org/packages/HeidiSQL,cinst -y heidisql.fireeye
 hexchat.fireeye,Creates a HexChat shortcut in the Utilities folder, common.fireeye - https://chocolatey.org/packages//vcredist2015 - https://chocolatey.org/packages//hexchat, Utilities, https://hexchat.github.io/, cinst -y hexchat.fireeye
+HTTP File Server (HFS),A lightweight graphical HTTP file server,common.fireeye - https://chocolatey.org/packages/hfs,Utilities,https://chocolatey.org/packages/hfs,cinst -y hfs.fireeye
 hxd.fireeye,A hex editor, common.fireeye - https://chocolatey.org/packages//hxd, Utilities, https://mh-nexus.de/en/hxd/, cinst -y hxd.fireeye
 hxd.flare,A hex editor, common.fireeye - https://chocolatey.org/packages//chocolatey, Hex Editor, https://mh-nexus.de/en/hxd/, cinst -y hxd.flare
 idafree.flare,IDA Free edition, , Disassemblers, https://www.hex-rays.com/products/ida/support/download_freeware.shtml, cinst -y idafree.flare
@@ -96,6 +100,7 @@ Internal-Monologue.fireeye,Internal Monologue Attack: Retrieving NTLM Hashes wit
 Inveigh.fireeye,Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool, common.fireeye - Invoke-TheHash.fireeye, Password Attacks,https://github.com/Kevin-Robertson/Inveigh, cinst -y Inveigh.fireeye
 Invoke-ACLPwn.fireeye,Invoke-ACLpwn is a tool that automates the discovery and pwnage of ACLs in Active Directory that are unsafe configured., , Exploitation,https://github.com/fox-it/Invoke-ACLPwn, cinst -y Invoke-ACLPwn.fireeye
 Invoke-CradleCrafter.fireeye,PowerShell Remote Download Cradle Generator & Obfuscator, , Evasion,https://github.com/danielbohannon/Invoke-CradleCrafter, cinst -y Invoke-CradleCrafter.fireeye
+Invoke-CredentialPhisher.fireeye,https://blog.fox-it.com/2018/08/14/phishing-ask-and-ye-shall-receive/,common.fireeye,Password Attacks,https://github.com/fox-it/Invoke-CredentialPhisher,cinst -y Invoke-CredentialPhisher.fireeye
 Invoke-DCOM.fireeye,Lateral Movement, , Exploitation,https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/Invoke-DCOM.ps1, cinst -y Invoke-DCOM.fireeye
 Invoke-DOSfuscation.fireeye,Cmd.exe Command Obfuscation Generator & Detection Test Harness, , Evasion,https://github.com/danielbohannon/Invoke-DOSfuscation, cinst -y Invoke-DOSfuscation.fireeye
 Invoke-Obfuscation.fireeye,PowerShell Obfuscator, , Evasion,https://github.com/danielbohannon/Invoke-Obfuscation, cinst -y Invoke-Obfuscation.fireeye
@@ -130,8 +135,11 @@ mobaxterm.fireeye,Creates a MobaXTerm shortcut in the Utilities folder, common.f
 nasm.fireeye,The Netwide Assembler and Disassembler, common.fireeye - https://chocolatey.org/packages//nasm, Developer, http://www.nasm.us/, cinst -y nasm.fireeye
 ncat.flare,Netcat utility, , Net, https://nmap.org/ncat/, cinst -y ncat.flare
 neo4j-community.fireeye,Installs start/stop scripts for Neo4j in the Utilities folder and disables auto start for Neo4j, common.fireeye - https://chocolatey.org/packages//jdk8 - https://chocolatey.org/packages//neo4j-community, Utilities, http://neo4j.com/, cinst -y neo4j-community.fireeye
+Net-GPPPassword.fireeye,.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.,common.fireeye,Information Gathering,https://github.com/outflanknl/Net-GPPPassword,cinst -y Net-GPPPassword.fireeye
 NetRipper.fireeye,NetRipper - Smart traffic sniffing for penetration testers, , Information Gathering,https://github.com/NytroRST/NetRipper, cinst -y NetRipper.fireeye
 NetshHelperBeacon.fireeye,Example DLL to load from Windows NetShell, , Exploitation,https://github.com/outflanknl/NetshHelperBeacon, cinst -y NetshHelperBeacon.fireeye
+virustotaluploader.fireeye,Uploads file hash to Virus Total,common.fireeye - https://chocolatey.org/packages/virustotaluploader,,https://chocolatey.org/packages/virustotaluploader,cinst virustotaluploader.fireeye
+NirLauncher.fireeye,"NirLauncher is a package of more than 180 portable freeware utilities for Windows, all of them developed by NirSoft.",common.fireeye,Utilities,https://chocolatey.org/packages/nirlauncher,cinst -y nirlauncher.fireeye
 nishang.fireeye,Nishang - Offensive PowerShell for red team penetration testing and offensive security., , Exploitation,https://github.com/samratashok/nishang, cinst -y nishang.fireeye
 nmap.fireeye,Creates shortcuts for nmap and Zenmap in the Information Gathering folder, , Information Gathering, https://nmap.org/, cinst -y nmap.fireeye
 nmap.flare,Creates shortcuts for nmap and Zenmap in the Information Gathering folder, , Net, https://nmap.org/, cinst -y nmap.flare
@@ -139,6 +147,7 @@ notepadplusplus-textfx.fireeye,Installs the TextFX plugin for 32 bit Notepad++,
 notepadplusplus.flare,Installs the TextFX plugin for 32 bit Notepad++, common.fireeye - https://chocolatey.org/packages//notepadplusplus, Utilities, https://notepad-plus-plus.org/, cinst -y notepadplusplus.flare
 nps.fireeye,Not PowerShell, , Evasion,https://github.com/Ben0xA/nps, cinst -y nps.fireeye
 NtdsAudit.fireeye,An Active Directory audit utility, , Vulnerability Analysis,https://github.com/Dionach/NtdsAudit, cinst -y NtdsAudit.fireeye
+OffensiveCSharp.fireeye,Collection of Offensive C# Tooling,common.fireeye,Exploitation,https://github.com/matterpreter/OffensiveCSharp,cinst -y OffensiveCSharp.fireeye
 officemalscanner.flare,Scan office documents for malware, , Office, http://www.reconstructer.org/, cinst -y officemalscanner.flare
 offvis.flare,OLESS binary file viewer, , Office, http://www.microsoft.com, cinst -y offvis.flare
 oledump.fireeye,A python file to analyze OLE files, common.fireeye - libraries.python2.fireeye, Office, https://didierstevens.com/, cinst -y oledump.fireeye
@@ -163,6 +172,7 @@ pestudio.flare,PE Viewer, , Utilities, https://www.winitor.com, cinst -y pestudi
 peview.flare,PE Viewer, , Utilities, http://wjradburn.com/software/, cinst -y peview.flare
 pidgin.fireeye,Creates a Pidgin Shortcut in the Utilities folder, common.fireeye - https://chocolatey.org/packages//pidgin, Utilities, http://pidgin.im/, cinst -y pidgin.fireeye
 pmalabs.flare,The labs for Practical Malware Analysis -- useful for learning reverse engineering and malware analysis, , Utilities, https://github.com/mikesiko/PracticalMalwareAnalysis-Labs, cinst -y pmalabs.flare
+powercat.fireeye,netshell features all in version 2 powershell ,common.fireeye,Networking Tools,https://github.com/besimorhino/powercat,cinst -y powercat.fireeye
 PowerLessShell.fireeye,Run PowerShell command without invoking powershell.exe, common.fireeye - https://chocolatey.org/packages//python2, Evasion,https://github.com/Mr-Un1k0d3r/PowerLessShell, cinst -y PowerLessShell.fireeye
 PowerLurk.fireeye,Malicious WMI Events using PowerShell, , Exploitation,https://github.com/Sw4mpf0x/PowerLurk, cinst -y PowerLurk.fireeye
 PowerPriv.fireeye,A Powershell implementation of PrivExchange designed to run under the current user's context, , Exploitation,https://github.com/G0ldenGunSec/PowerPriv, cinst -y PowerPriv.fireeye
@@ -172,6 +182,7 @@ PowerSploit.fireeye,A PowerShell Post-Exploitation Framework, , Exploitation,htt
 PowerUpSQL.fireeye,A PowerShell Toolkit for Attacking SQL Server, , Exploitation,https://github.com/NetSPI/PowerUpSQL, cinst -y PowerUpSQL.fireeye
 PowerView.fireeye,Installs the dev branch version of PowerView, common.fireeye - PowerSploit.fireeye, Information Gathering,https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon, cinst -y PowerView.fireeye
 ppee.fireeye,A PE file explorer for reverser and malware analyst, common.fireeye - https://chocolatey.org/packages//vcredist2010, Utilities, https://www.mzrst.com/, cinst -y ppee.fireeye
+Privesc.fireeye,Windows batch script that finds misconfiguration issues which can lead to privilege escalation.,common.fireeye - sysinternals.fireeye,Information Gathering,https://github.com/enjoiz/Privesc,cinst -y Privesc.fireeye
 PrivExchange.fireeye,Exchange your privileges for Domain Admin privs by abusing Exchange, common.fireeye - https://chocolatey.org/packages//python2 - impacket.fireeye, Exploitation\PrivExchange,https://github.com/dirkjanm/PrivExchange, cinst -y PrivExchange.fireeye
 Probable-Wordlists.fireeye,Wordlists sorted by probability originally created for password generation and testing, , Wordlists,https://github.com/berzerk0/Probable-Wordlists, cinst -y Probable-Wordlists.fireeye
 processdump.fireeye,Dump a running process, common.fireeye - https://chocolatey.org/packages//vcredist2015, Utilities, https://github.com/glmcdona/Process-Dump, cinst -y processdump.fireeye
@@ -179,12 +190,14 @@ processhacker.flare,A multi-purpose tool to monitor all running process and syst
 proxycap.fireeye,ProxyCap enables you to redirect your computer's network connections through proxy servers., , Networking, http://www.proxycap.com/, cinst -y proxycap.fireeye
 PSAmsi.fireeye,PSAmsi is a tool for auditing and defeating AMSI signatures., , Evasion,https://github.com/cobbr/PSAmsi, cinst -y PSAmsi.fireeye
 PSAttack.fireeye,A portable console aimed at making pentesting with PowerShell a little easier., , Evasion,https://github.com/jaredhaight/PSAttack, cinst -y PSAttack.fireeye
+PSBits.fireeye,Simple (mainly PowerShell) solutions allowing you to dig a bit deeper than usual. ,common.fireeye,Exploitation,https://github.com/gtworek/PSBits,cinst -y PSBits.fireeye
 PSReflect.fireeye,"Easily define in-memory enums, structs, and Win32 functions in PowerShell", , Exploitation,https://github.com/mattifestation/PSReflect, cinst -y PSReflect.fireeye
 putty.fireeye,Creates a PUTTY shortcut in the Networking Tools folder, common.fireeye - https://chocolatey.org/packages//putty.portable, Networking, http://www.chiark.greenend.org.uk/~sgtatham/putty/, cinst -y putty.fireeye
 PwnedPasswordsNTLM.fireeye,Quick binary search for NTLM hash dataset, , Vulnerability Analysis,https://github.com/JacksonVD/PwnedPasswordsNTLM, cinst -y PwnedPasswordsNTLM.fireeye
 py2exedecompiler.flare,py2exe decompiler, , Python, https://github.com/endgameinc/Py2ExeDecompiler, cinst -y py2exedecompiler.flare
 python2.x86.nopath.flare,, , Utilities, http://www.python.org/, cinst -y python2.x86.nopath.flare
 radare2.flare,A complete framework for reverse engineering and binary analysis, , Disassemblers, http://www.radare.org/r/, cinst -y radare2.flare
+Recon-AD.fireeye,"Recon-AD, an AD recon tool based on ADSI and reflective DLL�s",common.fireeye,Information Gathering,https://github.com/outflanknl/Recon-AD,cinst -y Recon-AD.fireeye
 RedTeamPowershellScripts.fireeye,Various PowerShell scripts from Mr-Un1k0d3r, , Exploitation,https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts, cinst -y RedTeamPowershellScripts.fireeye
 regshot.flare,Open source registry compare utility, , Utilities, https://sourceforge.net/projects/regshot/, cinst -y regshot.flare
 resourcehacker.flare,Utility to extract and modify embeded resources in PE files, common.fireeye - https://chocolatey.org/packages//reshack.portable, Utilities, http://www.angusj.com/resourcehacker/, cinst -y resourcehacker.flare
@@ -201,6 +214,7 @@ ScreenToGif.fireeye,Creates a ScreenToGif shortcut in the Utilities folder, comm
 Seatbelt.fireeye,Seatbelt is a C# project that performs a number of security oriented host-survey safety checks relevant from both offensive and defensive security perspectives., , Exploitation\GhostPack,https://github.com/GhostPack/Seatbelt, cinst -y Seatbelt.fireeye
 SecLists.fireeye,"SecLists is the security testers companion. It's a collection of multiple types of lists used during security assessments, collected in one place.", , Wordlists,https://github.com/danielmiessler/SecLists, cinst -y SecLists.fireeye
 SessionGopher.fireeye,SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP PuTTY SuperPuTTY FileZilla and Microsoft Remote Desktop. It can be run remotely or locally., , Password Attacks,https://github.com/Arvanaghi/SessionGopher, cinst -y SessionGopher.fireeye
+ShareAudit.fireeye,A tool for auditing network shares in an Active Directory environment ,common.fireeye,Information Gathering,https://github.com/Dionach/ShareAudit,cinst -y ShareAudit.fireeye
 Sharp-Suite.fireeye,Various C# tools from FuzzySec, , Exploitation,https://github.com/FuzzySecurity/Sharp-Suite, cinst -y Sharp-Suite.fireeye
 SharpClipHistory.fireeye,SharpClipHistory is a .NET application written in C# that can be used to read the contents of a user's clipboard history in Windows 10 starting from the 1809 Build., , Exploitation,https://github.com/mwrlabs/SharpClipHistory, cinst -y SharpClipHistory.fireeye
 SharpDPAPI.fireeye,SharpDPAPI is a C# port of some Mimikatz DPAPI functionality., , Exploitation\GhostPack,https://github.com/GhostPack/SharpDPAPI, cinst -y SharpDPAPI.fireeye
@@ -227,8 +241,12 @@ SublimeText3.fireeye,Creates a Sublime Text 3 shortcut in the Utilities folder a
 SysAnalyzer.flare,Process monitoring tool, , Utilities, http://sandsprite.com/iDef/SysAnalyzer/, cinst -y SysAnalyzer.flare
 sysinternals.fireeye,Creates a shortcut for all Sysinternals tools in the Active Directory Tools folder, common.fireeye - https://chocolatey.org/packages//sysinternals, Active Directory, http://technet.microsoft.com/en-us/sysinternals/bb842062, cinst -y sysinternals.fireeye
 sysinternals.flare,Creates a shortcut for all Sysinternals tools in the Active Directory Tools folder, common.fireeye - https://chocolatey.org/packages//sysinternals, Utilities, http://technet.microsoft.com/en-us/sysinternals/bb842062, cinst -y sysinternals.flare
+SysWhispers.fireeye,AV/EDR evasion via direct system calls. ,common.fireeye,Evasion,https://github.com/jthuraisamy/SysWhispers,cinst -y SysWhispers.fireeye
 telnet.fireeye,Creates a Telnet shortcut in the Networking Tools directory, common.fireeye - https://chocolatey.org/packages//telnet, Networking, https://technet.microsoft.com/en-us/library/bb491013.aspx, cinst -y telnet.fireeye
+ThreadContinue.fireeye,Reflective DLL injection using SetThreadContext() and NtContinue(),common.fireeye,Exploitation,https://github.com/zerosum0x0/ThreadContinue,cinst -y ThreadContinue.fireeye
 thunderbird.fireeye,Creates a shortcut for Mozilla Thunderbird in the Utilities folder, common.fireeye - https://chocolatey.org/packages//chocolatey-core.extension - https://chocolatey.org/packages//thunderbird, Utilities, https://www.mozilla.org/en/thunderbird/, cinst -y thunderbird.fireeye
+TikiTorch.fireeye,Process Injection,common.fireeye,Exploitation,https://github.com/rasta-mouse/TikiTorch,cinst -y TikiTorch.fireeye
+Tor Browser,Tor Browser,common.fireeye - https://chocolatey.org/packages/tor-browser,Utilities,https://chocolatey.org/packages/tor-browser,cinst -y tor-browser.fireeye
 TrustVisualizer.fireeye,Python script that takes new output from Get-DomainTrustMapping .csvs and outputs graphml. Based on DomainTrustExplorer., common.fireeye - https://chocolatey.org/packages//python3 - https://chocolatey.org/packages//python2 - libraries.python2.fireeye, Utilities,https://github.com/HarmJ0y/TrustVisualizer, cinst -y TrustVisualizer.fireeye
 UACME.fireeye,Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor., , Exploitation,https://github.com/hfiref0x/UACME, cinst -y UACME.fireeye
 uniextract2.fireeye,A universal file extractor, , Utilities, https://github.com/Bioruebe/UniExtract2, cinst -y uniextract2.fireeye
@@ -10,7 +10,10 @@
        {"name": "dotnet4.6.2"},
        {"name": "dotnet4.7.2"},
        {"name": "cmder.fireeye"},
-        {"name": "git"},
+        {
+            "name": "git",
+            "args": "--params \'/GitOnlyOnPath /NoShellIntegration\'"
+        },
        {"name": "adobereader.fireeye"},
        {"name": "jre8"},
        {"name": "wireshark.fireeye"},
@@ -58,6 +61,13 @@
        {"name": "vnc-viewer.fireeye"},
        {"name": "hashcat.fireeye"},
        {"name": "hashcheck"},
+        {"name": "qbittorrent"},
+        {"name": "dbeaver"},
+        {"name": "hfsexplorer"},
+        {"name": "lockhunter"},
+        {"name": "simplednscrypt.fireeye"},
+        {"name": "heidisql.fireeye"},
+        {"name": "hfs.fireeye"},
        {
            "name": "neo4j-community.fireeye",
            "x64Only": true
@@ -90,7 +100,10 @@
        {"name": "burp.free.fireeye"},
        {"name": "kali.fireeye", "args": "--timeout 7200"},
        {"name": "kali_windowsbinaries.fireeye"},
+        {"name": "nirlauncher.fireeye"},
        {"name": "unxUtils"},
+        {"name": "virustotaluploader"},
+        {"name": "tor-browser.fireeye"},

        {"name": "ADACLScanner.fireeye"},
        {"name": "ADAPE-Script.fireeye"},
@@ -99,9 +112,12 @@
        {"name": "amass.docker.fireeye"},
        {"name": "ASREPRoast.fireeye"},
        {"name": "BloodHound.fireeye"},
+        {"name": "BeRoot.fireeye"},
+        {"name": "Bloodhound-Custom-Queries.fireeye"},
        {"name": "CheckPlease.fireeye"},
        {"name": "CredNinja.fireeye"},
        {"name": "DAMP.fireeye"},
+        {"name": "Dumpert.fireeye"},
        {"name": "contextmenu.fireeye"},
        {"name": "CrackMapExec.fireeye"},
        {"name": "CrackMapExecWin.fireeye"},
@@ -115,6 +131,7 @@
        {"name": "Exchange-AD-Privesc.fireeye"},
        {"name": "flare-floss.fireeye"},
        {"name": "fuzzdb.fireeye"},
+        {"name": "GadgetToJScript.fireeye"},
        {"name": "Generate-Macro.fireeye"},
        {"name": "Get-LAPSPasswords.fireeye"},
        {"name": "Get-ReconInfo.fireeye"},
@@ -147,12 +164,14 @@
        {"name": "metatwin.fireeye"},
        {"name": "Mimikatz.fireeye"},
        {"name": "mimikittenz.fireeye"},
+        {"name": "Net-GPPPassword.fireeye"},
        {"name": "NetshHelperBeacon.fireeye"},
        {"name": "nishang.fireeye"},
        {"name": "nps.fireeye"},
+        {"name": "OffensiveCSharp.fireeye"},
        {"name": "pafishmacro.fireeye"},
        {"name": "PayloadsAllTheThings.fireeye"},
-        {"name": "PoshC2.fireeye"},
+        {"name": "powercat.fireeye"},
        {"name": "PowerLessShell.fireeye"},
        {"name": "PowerLurk.fireeye"},
        {"name": "PowerPriv.fireeye"},
@@ -161,10 +180,13 @@
        {"name": "PowerSploit.fireeye"},
        {"name": "PowerUpSQL.fireeye"},
        {"name": "PowerView.fireeye"},
+        {"name": "Privesc.fireeye"},
        {"name": "PrivExchange.fireeye"},
        {"name": "PSAmsi.fireeye"},
        {"name": "PSAttack.fireeye"},
+        {"name": "PSBits.fireeye"},
        {"name": "PSReflect.fireeye"},
+        {"name": "Recon-AD.fireeye"},
        {"name": "RedTeamPowershellScripts.fireeye"},
        {"name": "RiskySPN.fireeye"},
        {"name": "Rubeus.fireeye"},
@@ -185,13 +207,14 @@
        {"name": "SpoolerScanner.fireeye"},
        {"name": "StarFighters.fireeye"},
        {"name": "SpoolSample.fireeye"},
+        {"name": "SysWhispers.fireeye"},
+        {"name": "ThreadContinue.fireeye"},
+        {"name": "TikiTorch.fireeye"},
        {"name": "UACME.fireeye"},
        {"name": "vssown.fireeye"},
        {"name": "WMImplant.fireeye"},
        {"name": "WMIOps.fireeye"},
        {"name": "zBang.fireeye"},
-        {"name": "Elite.fireeye"},
-        {"name": "covenant.fireeye"},
        {"name": "ad-control-paths.fireeye"},
        {"name": "defendercheck.fireeye"},
        {"name": "dnsrecon.fireeye"},
@@ -207,7 +230,7 @@
        {"name": "vulcan.fireeye"},
        {"name": "RobotsDisallowed.fireeye"},
        {"name": "Probable-Wordlists.fireeye"},
-        {"name": "PwndPasswordsNTLM.fireeye"},
+        {"name": "PwnedPasswordsNTLM.fireeye"},
        {"name": "RottenPotatoNG.fireeye"},
        {"name": "SharpClipHistory.fireeye"},
        {"name": "SharpSploit.fireeye"},