Various commands, tools, techniques that you can use to examine live Windows systems for signs of Compromise or for Threat Hunting.Can also be used to create a baseline for your environment.For the bests results "Run as Administrator" through CMD and Powershell.
☆15May 30, 2026Updated 5 months ago
Alternatives and similar repositories for Windows-Forensic-Examination-and-Threat-Hunting
Users that are interested in Windows-Forensic-Examination-and-Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Powershell collection designed to assist in Threat Hunting Windows systems.☆27Apr 13, 2018Updated 8 years ago
- Windows log and threat hunting with powershell☆16Dec 11, 2020Updated 5 years ago
- Detection rules and threat hunting queries in Defender XDR and Azure Sentinel☆17Mar 13, 2026Updated 7 months ago
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 3 years ago
- Reproducible forensics environment, 100% of the time☆12Aug 5, 2024Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- PowerShell Script for Agentless Incident Response☆25Apr 5, 2018Updated 8 years ago
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Jun 3, 2018Updated 8 years ago
- Scripts to inject demo data and network traffic into an existing Alienvault/OSSIM installation☆21Jul 4, 2017Updated 9 years ago
- Simple Script to Help You Find All Files Has Been Modified, Accessed, and Created In A Range Time.☆27Dec 1, 2022Updated 3 years ago
- Repo containing all info, scripts, etc. related to CVE-2021-44228☆10Dec 29, 2021Updated 4 years ago
- Phần mềm Quản lý Học viên Trung tâm Anh ngữ - Đồ án Phân tích thiết kế Hệ thống thông tin☆10Jul 6, 2016Updated 10 years ago
- Repository resource for threat hunter☆160Sep 14, 2018Updated 8 years ago
- ☆33Dec 4, 2022Updated 3 years ago
- Web based user interface for OpenRelik☆13Jun 21, 2026Updated 4 months ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆98May 28, 2023Updated 3 years ago
- Scanner which is capable of scanning multiple hosts or multiple subnets on an SSL port and output a CSV file with the certificate details…☆14Nov 29, 2013Updated 12 years ago
- Little utility scripts for the Zeek Network Security Monitor☆14Apr 28, 2021Updated 5 years ago
- Converts exported results of CAPA tool from .json format to another formats supporting by different tools.☆22Feb 15, 2022Updated 4 years ago
- A series of PowerShell scripts to automate collection of forensic artefacts in most Incident Response environments☆65Jan 31, 2022Updated 4 years ago
- A Python script that analyzes log files for suspicious activities by detecting keywords, weighted importance, and failed login attempts.☆11Aug 20, 2024Updated 2 years ago
- A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.☆38Mar 25, 2024Updated 2 years ago
- A collection of handy and specific tools for the Red Teamer☆11Aug 13, 2024Updated 2 years ago
- Automatically generated Sysmon parser for Azure Sentinel☆18Jan 6, 2026Updated 9 months ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- Yara rules☆22Mar 27, 2023Updated 3 years ago
- ☆13Sep 22, 2022Updated 4 years ago
- A reasonably performant TF-IDF implementation.☆12Nov 20, 2022Updated 3 years ago
- Zeek scripts that provide an alternative log file logging TLS/SSL traffic☆12Oct 22, 2026Updated last week
- Threat Hunt Investigation Methodology and Procedure☆15Jul 11, 2022Updated 4 years ago
- ☆16Jan 15, 2025Updated last year
- Cloud threat detection visualization from excalidraw☆12Apr 25, 2022Updated 4 years ago
- Repo to track SANS BlueTeam Summit Presentation☆23Oct 4, 2022Updated 4 years ago
- Enhanced-PsExec the GUI edition☆13Sep 8, 2021Updated 5 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Demo tích hợp cổng thanh toán SDK của MoMo☆12Jan 5, 2022Updated 4 years ago
- Learn how to get more out of publicly available threat reports to help improve the security posture of your organization! TLP: White Thre…☆15Jun 5, 2023Updated 3 years ago
- CISCO configuration guides☆14Feb 16, 2020Updated 6 years ago
- Userland API monitor for threat hunting☆58Mar 4, 2020Updated 6 years ago
- Repository with Sample threat hunting notebooks on Security Event Log Data Sources☆70Dec 2, 2022Updated 3 years ago
- ☆17Aug 27, 2022Updated 4 years ago
- A simple, small in size and portable keylogger for Windows XP/Vista/7/8/10/11 that doesn't require .NET Framework.☆15Feb 16, 2022Updated 4 years ago