Various commands, tools, techniques that you can use to examine live Windows systems for signs of Compromise or for Threat Hunting.Can also be used to create a baseline for your environment.For the bests results "Run as Administrator" through CMD and Powershell.
☆15May 30, 2026Updated 2 weeks ago
Alternatives and similar repositories for Windows-Forensic-Examination-and-Threat-Hunting
Users that are interested in Windows-Forensic-Examination-and-Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Powershell collection designed to assist in Threat Hunting Windows systems.☆27Apr 13, 2018Updated 8 years ago
- Windows log and threat hunting with powershell☆16Dec 11, 2020Updated 5 years ago
- Detection rules and threat hunting queries in Defender XDR and Azure Sentinel☆17Mar 13, 2026Updated 3 months ago
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 2 years ago
- Detecting Cobalt Strike Team Servers on targets through traffic telemetry.☆22Aug 13, 2024Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.☆20Nov 13, 2022Updated 3 years ago
- Azure AD Incident Response☆28Oct 8, 2021Updated 4 years ago
- PowerShell Script for Agentless Incident Response☆25Apr 5, 2018Updated 8 years ago
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Jun 3, 2018Updated 8 years ago
- ☆33Dec 4, 2022Updated 3 years ago
- Zeek scripts that provide an alternative log file logging TLS/SSL traffic☆12May 4, 2021Updated 5 years ago
- Scanner which is capable of scanning multiple hosts or multiple subnets on an SSL port and output a CSV file with the certificate details…☆14Nov 29, 2013Updated 12 years ago
- Repository for my GitHub Universe 2023 session SEC1808M☆10Nov 8, 2023Updated 2 years ago
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97May 28, 2023Updated 3 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Converts exported results of CAPA tool from .json format to another formats supporting by different tools.☆22Feb 15, 2022Updated 4 years ago
- A collection of handy and specific tools for the Red Teamer☆11Aug 13, 2024Updated last year
- scripting IDA like a Pro☆24Oct 27, 2020Updated 5 years ago
- Purpleteam scripts simulation & Detection - trigger events for SOC detections☆203Dec 20, 2024Updated last year
- Proton Drive integration for Home Assistant (compatible with HACS)☆28Updated this week
- A reasonably performant TF-IDF implementation.☆12Nov 20, 2022Updated 3 years ago
- Yara rules☆21Mar 27, 2023Updated 3 years ago
- Penetration Testing Checklist☆36May 14, 2020Updated 6 years ago
- A series of PowerShell scripts to automate collection of forensic artefacts in most Incident Response environments☆65Jan 31, 2022Updated 4 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Hunt malware with Volatility☆52Mar 3, 2026Updated 3 months ago
- A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.☆39Mar 25, 2024Updated 2 years ago
- Threat Hunt Investigation Methodology and Procedure☆15Jul 11, 2022Updated 3 years ago
- Automatically generated Sysmon parser for Azure Sentinel☆18Jan 6, 2026Updated 5 months ago
- Home Assisstant custom integration to provide data from Samsung SmartThings Find, such as SmartTag locations☆31Jun 11, 2025Updated last year
- Cloud threat detection visualization from excalidraw☆12Apr 25, 2022Updated 4 years ago
- A Mixture‑of‑Experts Educational Framework for Adaptive Cybersecurity☆20Feb 8, 2026Updated 4 months ago
- A completely unsupported set of scripts used in SANS FOR572, Advanced Network Forensics and Analysis☆29Aug 6, 2025Updated 10 months ago
- Repo to track SANS BlueTeam Summit Presentation☆23Oct 4, 2022Updated 3 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Learn how to get more out of publicly available threat reports to help improve the security posture of your organization! TLP: White Thre…☆15Jun 5, 2023Updated 3 years ago
- Userland API monitor for threat hunting☆58Mar 4, 2020Updated 6 years ago
- A small threat model for a smart home☆21Oct 8, 2019Updated 6 years ago
- Kaze's openly available CVE vulnerability data.☆16Apr 7, 2025Updated last year
- CISCO configuration guides☆14Feb 16, 2020Updated 6 years ago
- Enhanced-PsExec the GUI edition☆13Sep 8, 2021Updated 4 years ago
- Commands used in Windows penetration tests☆54Jan 19, 2026Updated 4 months ago