WindowsSecurityAudit

1.6.2

Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories - threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN journal, Sysmon ana
Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories - threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN journal, Sysmon analytics), SIEM integration (Splunk HEC, Microsoft Sentinel, CEF/NDJSON), threat intelligence feeds (abuse.ch, AbuseIPDB, MISP, TAXII/STIX), Active Directory security, hardening baselines and automated remediation. Runs on Windows PowerShell 5.1+ and PowerShell 7. Locale-invariant core checks since v1.6.0: compliance, audit-policy, account and ACL checks use APIs, GUIDs and SIDs instead of localized console output (correct results on Turkish, German, French and other non-English Windows). Known exception: Get-FileSystemJournal still parses English fsutil output (see README Known Limitations). Core checks are dependency-free; AD functions require the ActiveDirectory module (RSAT) and cloud functions the Microsoft Graph SDK. Free and open source - support development: https://buymeacoffee.com/okanyildizr
Show more

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name WindowsSecurityAudit

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name WindowsSecurityAudit

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Okan YILDIZ. All rights reserved.

Package Details

Author(s)

  • Okan YILDIZ

Tags

Security Audit DFIR ThreatHunting Compliance MITRE IncidentResponse Vulnerability Windows BlueTeam

Functions

Compare-SecurityBaseline ConvertTo-SiemEvent Enable-AuditPolicies Enable-PowerShellSecurity Export-AttackNavigatorLayer Export-ComplianceEvidence Export-MemoryDump Export-SecurityReport Find-ADBackdoors Find-ADVulnerabilities Find-APTIndicators Find-DataExfiltration Find-DefenseEvasion Find-EOLSoftware Find-LateralMovement Find-LivingOffLand Find-NetworkAnomalies Find-PersistenceMechanisms Find-StaleADObjects Find-SuspiciousAuthentication Find-SuspiciousProcesses Get-ADPasswordPolicy Get-ADPrivilegedAccounts Get-ArtifactCollection Get-AzureADRiskySignIns Get-CloudComplianceStatus Get-ComplianceReport Get-CredentialAccessEvents Get-DefenderStatus Get-EventIdDescription Get-EventLogAnalysis Get-ExecutionArtifacts Get-ExposedServices Get-FileSystemAnalysis Get-FileSystemJournal Get-MemoryAnalysis Get-MITREAttackMapping Get-MultiSystemAudit Get-NVDCveData Get-RegistryAnalysis Get-SecurityBaseline Get-SecurityMetrics Get-SecurityMisconfigurations Get-SysmonAnalytics Get-SystemInfo Get-ThreatIntelligence Get-USBHistory Get-UserActivityArtifacts Get-VulnerabilityAssessment Invoke-DefenderScan Invoke-EnterpriseSecurityScan Invoke-ForensicCollection Invoke-IncidentResponse Invoke-SecurityAssessment Invoke-SecurityRemediation New-ConsolidatedReport New-ExecutiveReport New-ForensicTimeline New-SecurityDashboard Register-ScheduledSecurityScan Resolve-CpeName Send-SiemEvent Set-SecurityBaseline Test-ADSecurityPosture Test-CertificateHealth Test-CISBenchmark Test-M365SecurityPosture Test-NISTCompliance Test-PatchCompliance Test-PciDssCompliance Test-SystemIntegrity Update-DefenderConfiguration

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

https://github.com/okanyildiz/WindowsSecurityAudit/releases

FileList

Version History

Version Downloads Last updated
1.6.2 (current version) 9 10/29/2026
1.6.1 7 10/28/2026
1.6.0 12 10/26/2026