
PowerShell enumeration script for discovering service-backed COM objects via CLSID/AppID correlation and activation testing.
Invoke-CLSIDFinder enumerates CLSID and AppID entries from the Windows registry to identify COM objects associated with Windows services via the LocalService value.
The function correlates these entries, exports the results to a CSV file, and attempts COM activation when the related service is running. It is primarily intended to help identify usable CLSIDs during relay attacks and other LPE scenarios.
PS C:\Users\Administrator\Desktop> Import-Module .\CLSIDFinder.ps1
PS C:\Users\Administrator\Desktop> Invoke-CLSIDFinder

https://github.com/ohpe/juicy-potato/blob/master/CLSID/GetCLSID.ps1