A cloud forensics module to run threat hunting playbooks on data from Azure and O365

A comprehensive PowerShell toolkit for threat hunting, digital forensics, and incident response (DFIR). Provides "Hunt" functions to detect persistence mechanisms, analyze system artifacts, search event logs, and generate detailed forensic reports.

Enumerates all known Windows autostart / persistence locations (everything Sysinternals Autoruns covers plus COM hijacks, UAC bypass hijacks, PowerShell profiles, browser extensions, BITS, hidden scheduled tasks and more) and maps every entry to MITRE ATT&CK. Pure PowerShell, no external binaries.

Incident response for Microsoft 365 / Entra ID: hunts one tenant or a list for an incident's indicators (vendor app service principals, roles, new credentials, directory audits, sign-ins from IOC IPs) and writes a severity-sorted report with raw evidence. Ships the October 2026 ConnectWise SkyKick indicator set. Windows PowerShell 5.1 compatible.