PowerShell Modules in System32 - Are these standard defaults?
I have been experimenting with PowerShell and noticed there are a ton of modules in C:\Windows\System32\WindowsPowerShell\v1.0\Modules
Here's a list of everything in that folder:
AppBackgroundTask
AppLocker
AppvClient
Appx
AssignedAccess
BitLocker
BitsTransfer
BranchCache
CimCmdlets
ConfigCI
ConfigDefender
Defender
DeliveryOptimization
DirectAccessClientComponents
Dism
DnsClient
EventTracingManagement
International
iSCSI
ISE
Kds
Microsoft.PowerShell.Archive
Microsoft.PowerShell.Diagnostics
Microsoft.PowerShell.Host
Microsoft.PowerShell.LocalAccounts
Microsoft.PowerShell.Management
Microsoft.PowerShell.ODataUtils
Microsoft.PowerShell.Security
Microsoft.PowerShell.Utility
Microsoft.WSMan.Management
MMAgent
MsDtc
NetAdapter
NetConnection
NetEventPacketCapture
NetLbfo
NetNat
NetQos
NetSecurity
NetSwitchTeam
NetTCPIP
NetworkConnectivityStatus
NetworkSwitchManager
NetworkTransition
PcsvDevice
PersistentMemory
PKI
PnpDevice
PrintManagement
ProcessMitigations
Provisioning
PSDesiredStateConfiguration
PSDiagnostics
PSScheduledJob
PSWorkflow
PSWorkflowUtility
ScheduledTasks
SecureBoot
SmbShare
SmbWitness
StartLayout
Storage
StorageBusCache
TLS
TroubleshootingPack
TrustedPlatformModule
UEV
VpnClient
Wdac
Whea
WindowsDeveloperLicense
WindowsErrorReporting
WindowsSearch
WindowsUpdate
WindowsUpdateProvider
Are all of these standard with Win10? Just making sure I haven't been pwn'd. :)
Thanks.
This has been a thing since Powershell was added, made part of the Windows OS.
No one who'd pawn your machine would ever leave this big of an easily visible footprint.
Modules are included in your PowerShell path for a reason as well.
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_psmodulepath?view=powershell-7.1
$env:PSModulePath -split ';'
# Results
<#
C:\Users\postanote\OneDrive\Documents\WindowsPowerShell\Modules
C:\Program Files\WindowsPowerShell\Modules
C:\Windows\system32\WindowsPowerShell\v1.0\Modules
C:\Program Files (x86)\Microsoft SQL Server\150\Tools\PowerShell\Modules\
#>
A quick web search would point you to all you'd need to know:
https://duckduckgo.com/?q=%27powershell+module+location%27&t=h_&ia=web
Example hit: https://www.educba.com/powershell-executable-location
$env:Path -split ';'|clip
# Results
<#
...
C:\Windows\system32
C:\Windows
C:\Windows\System32\Wbem
C:\Windows\System32\WindowsPowerShell\v1.0\
C:\Windows\System32\OpenSSH\
...
#>
So, if the PowerShell executable(s) are in the same location, you'd expect all its defaults to be there as well since they are required for PowerShell to work.