Skip to content

Instantly share code, notes, and snippets.

@cachius
cachius / CIPolicyParser.ps1
Created November 19, 2025 14:04
Functions to recover information from binary Windows Defender Application Control (WDAC) Code Integrity policies.
# Ensure System.Security assembly is loaded.
Add-Type -AssemblyName System.Security
function ConvertTo-CIPolicy {
<#
.SYNOPSIS
Converts a binary file that contains a Code Integrity policy into XML format.
Author: Matthew Graeber (@mattifestation)
@cachius
cachius / Enumerate-URIHandlers.ps1
Created February 27, 2025 12:42 — forked from mgeeky/Enumerate-URIHandlers.ps1
Enumerate Windows URI Handlers (Keys in HKEY_CLASSES_ROOT that contain "URL Protocol" values), examples: http:, calculator:, ms-officecmd:
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT -ErrorAction SilentlyContinue | Out-Null
$count = 0
try {
Get-ChildItem HKCR: -ErrorAction SilentlyContinue | ForEach-Object {
if((Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).PSObject.Properties.Name -contains "URL Protocol") {
$name = $_.PSChildName
$count += 1
$line = "URI Handler {0:d4}: {1}" -f $count, $name
Write-Host $line
}
@cachius
cachius / Doc2Pdf
Created August 15, 2024 14:43 — forked from mkoertgen/ Doc2Pdf
A powershell automating Word to generate Pdf
A powershell automating Word to generate Pdf