$path      = "C:\Temp\random20GB.bin"
$sizeBytes = [long]20GB
$chunkSize = [int]64MB

$buffer = New-Object byte[] $chunkSize
$rng    = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$fs     = [System.IO.File]::Open($path, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write)

try {
    $written = [long]0
    while ($written -lt $sizeBytes) {
        $toWrite = [int][Math]::Min([long]$chunkSize, $sizeBytes - $written)
        $rng.GetBytes($buffer)
        $fs.Write($buffer, 0, $toWrite)
        $written += $toWrite
        Write-Progress -Activity "Generating file" `
            -Status ("{0:N1} / {1:N1} GB" -f ($written/1GB), ($sizeBytes/1GB)) `
            -PercentComplete (($written / $sizeBytes) * 100)
    }
}
finally {
    $fs.Close()
    $rng.Dispose()
}

It is no new tool, but don’t forget the old Resource Monitor when you are on the search for the “hugger”.

Windows + R : Resmon

SigninLogs
| mv-expand AuthenticationDetails = parse_json(AuthenticationDetails)
| where TimeGenerated > ago(120d)
| where AuthenticationDetails.authenticationMethod == "Text message"
| project  UserPrincipalName, AuthenticationDetails.authenticationMethod, AuthenticationDetails.authenticationMethodDetail
| summarize count()by UserPrincipalName

https://www.starwindsoftware.com/tmplink/starwindconverter.exe

https://hightable.io/category/iso27001-annex-a-controls

First we create a bat file that will do 2 things

1. It will loop every 10 seconds
2. It will call another bat file. We do this in case we need to make changes, we don’t need to build the EXE file every time
3. We call it c:\path\set_reg_loader.bat

:loop
call c:\path\set_reg.bat
timeout /t 10 /nobreak
GOTO :loop

The we create the c:\path\set_reg.bat file that actually do the registry stuff

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "Server1.dk was here" /t REG_DWORD /d 1 /f

Now we create the exe file

1. Run C:\Windows\System32\iexpress.exe as Administrator

You can decide if you want to save the project

Now you have a nice EXE file that will go undetected by most security systems

Create the windows service that will run the exe file.

Start a CMD as administrator

sc create SetReg binPath= "C:\path\set_reg.EXE" DisplayName= SetRegDisplayname start= Auto obj= "NT AUTHORITY\System"

We now have a EXE file that runs as a service as Local System

Windows 11 Enterprise | Microsoft Evaluation Center