Powershell
Browse 42 powershell tools
FEATURED
A repository documenting AppLocker bypass techniques with verified methods, legacy DLL execution approaches, and a PowerShell module for identifying AppLocker weaknesses.
FLARE-VM is a Windows virtual machine setup tool that automates the installation and configuration of reverse engineering and malware analysis software using Chocolatey and Boxstarter technologies.
A PowerShell-based incident response and live forensic data acquisition tool for Windows hosts.
A collection of PowerShell modules for artifact gathering and reconnaissance of Windows-based endpoints.
CimSweep is a suite of CIM/WMI-based tools for incident response and hunting operations on Windows systems without the need to deploy an agent.
A comprehensive PowerShell cheat sheet covering various tasks and techniques for file management, process management, network operations, and system administration.
A comprehensive resource for securing Active Directory, including attack methods and effective defenses.
Ebowla is a tool for generating payloads in Python, GO, and PowerShell with support for Reflective DLLs.
Powerful PowerShell script for identifying missing software patches for local privilege escalation vulnerabilities.
A PowerShell toolkit for penetration testing Microsoft Azure environments, providing discovery, configuration auditing, and post-exploitation capabilities.
Powershell Threat Hunting Module for scanning remote endpoints and collecting comprehensive information.
Cheat sheet with common enumeration and attack methods for Windows Active Directory.
A PowerShell module for interacting with VirusTotal to analyze suspicious files and URLs.
A blog post about bypassing AppLocker using PowerShell diagnostic scripts
A PowerShell script to interact with the MITRE ATT&CK Framework via its own API using the deprecated MediaWiki API.
A modular incident response framework in Powershell that uses Powershell Remoting to collect data for incident response and breach hunts.
Container of 200 Windows EVTX samples for testing detection scripts and training on DFIR.
Monitor WMI consumers and processes for potential malicious activity
