A Digital Forensics framework for Windows PowerShell.

Tooling to assist in Azure AD incident response

A Digital Forensics framework for Windows PowerShell.

A Digital Forensics framework for Windows PowerShell.

The module allows a fast and easy way to contain and remediate a threat on a remote host.

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

Security assessment, threat detection, and continuous monitoring module for Google Workspace, Active Directory, and Microsoft cloud environments. Includes Google Workspace compromise assessment with 23 detection signals, Active Directory reconnaissance (205 security checks across 15 categories including transitive Tier-0 attack-path analysis, NTLM-... More info

PowerTriage Windows CE is a native PowerShell triage script designed for Incident Response (DFIR) and forensic triage on compromised Windows systems. It focuses on practical live response, low deployment friction, and dependency-free artifact collection in the Community Edition. Community Edition highlights: - Native PowerShell: Runs on standard P... More info

A comprehensive PowerShell toolkit for threat hunting, digital forensics, and incident response (DFIR). Provides "Hunt" functions to detect persistence mechanisms, analyze system artifacts, search event logs, and generate detailed forensic reports.

Deterministic local log scrubber that builds token maps, scrubs logs, reports failed files, and supports safe release workflows.

Read-only Windows first-response evidence collection with offline reporting and hardened SHA-256 integrity verification.

Detects an intruder who is already inside a Microsoft Entra ID tenant. Plants decoy users, application registrations and client secrets that no legitimate process should ever touch, watches the Microsoft Graph sign-in and directory audit logs for contact with them, and scores every touch through a calibrated false-positive suppression engine before... More info

Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories - threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN... More info

Enumerates all known Windows autostart / persistence locations (everything Sysinternals Autoruns covers plus COM hijacks, UAC bypass hijacks, PowerShell profiles, browser extensions, BITS, hidden scheduled tasks and more) and maps every entry to MITRE ATT&CK. Pure PowerShell, no external binaries.

Incident response for Microsoft 365 / Entra ID: hunts one tenant or a list for an incident's indicators (vendor app service principals, roles, new credentials, directory audits, sign-ins from IOC IPs) and triages Unified Audit Log exports for mailbox compromise (inbox rules, mail read, sign-ins, IP geolocation), writing severity-sorted reports with... More info