Various commands, tools, techniques that you can use to examine live Windows systems for signs of Compromise or for Threat Hunting.Can also be used to create a baseline for your environment.For the bests results "Run as Administrator" through CMD and Powershell.
☆15Aug 15, 2022Updated 3 years ago
Alternatives and similar repositories for Windows-Forensic-Examination-and-Threat-Hunting
Users that are interested in Windows-Forensic-Examination-and-Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Powershell collection designed to assist in Threat Hunting Windows systems.☆27Apr 13, 2018Updated 8 years ago
- Windows log and threat hunting with powershell☆16Dec 11, 2020Updated 5 years ago
- Detection rules and threat hunting queries in Defender XDR and Azure Sentinel☆16Mar 13, 2026Updated last month
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 2 years ago
- Detecting Cobalt Strike Team Servers on targets through traffic telemetry.☆22Aug 13, 2024Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.☆21Nov 13, 2022Updated 3 years ago
- Azure AD Incident Response☆28Oct 8, 2021Updated 4 years ago
- PowerShell Script for Agentless Incident Response☆25Apr 5, 2018Updated 8 years ago
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Jun 3, 2018Updated 7 years ago
- ☆33Dec 4, 2022Updated 3 years ago
- Repo containing all info, scripts, etc. related to CVE-2021-44228☆10Dec 29, 2021Updated 4 years ago
- Zeek scripts that provide an alternative log file logging TLS/SSL traffic☆12May 4, 2021Updated 4 years ago
- Scanner which is capable of scanning multiple hosts or multiple subnets on an SSL port and output a CSV file with the certificate details…☆14Nov 29, 2013Updated 12 years ago
- Repository for my GitHub Universe 2023 session SEC1808M☆10Nov 8, 2023Updated 2 years ago
- Serverless GPU API endpoints on Runpod - Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97May 28, 2023Updated 2 years ago
- Converts exported results of CAPA tool from .json format to another formats supporting by different tools.☆22Feb 15, 2022Updated 4 years ago
- A collection of handy and specific tools for the Red Teamer☆11Aug 13, 2024Updated last year
- Purpleteam scripts simulation & Detection - trigger events for SOC detections☆196Dec 20, 2024Updated last year
- scripting IDA like a Pro☆24Oct 27, 2020Updated 5 years ago
- Proton Drive integration for Home Assistant (compatible with HACS)☆20Updated this week
- A reasonably performant TF-IDF implementation.☆12Nov 20, 2022Updated 3 years ago
- Yara rules☆22Mar 27, 2023Updated 3 years ago
- Penetration Testing Checklist☆37May 14, 2020Updated 5 years ago
- Deploy open-source AI quickly and easily - Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- A series of PowerShell scripts to automate collection of forensic artefacts in most Incident Response environments☆65Jan 31, 2022Updated 4 years ago
- Hunt malware with Volatility☆49Mar 3, 2026Updated last month
- A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.☆38Mar 25, 2024Updated 2 years ago
- A completely unsupported set of scripts used in SANS FOR572, Advanced Network Forensics and Analysis☆28Aug 6, 2025Updated 8 months ago
- Threat Hunt Investigation Methodology and Procedure☆15Jul 11, 2022Updated 3 years ago
- Automatically generated Sysmon parser for Azure Sentinel☆18Jan 6, 2026Updated 3 months ago
- Home Assisstant custom integration to provide data from Samsung SmartThings Find, such as SmartTag locations☆31Jun 11, 2025Updated 10 months ago
- Cloud threat detection visualization from excalidraw☆12Apr 25, 2022Updated 3 years ago
- A Mixture‑of‑Experts Educational Framework for Adaptive Cybersecurity☆22Feb 8, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Repo to track SANS BlueTeam Summit Presentation☆23Oct 4, 2022Updated 3 years ago
- Learn how to get more out of publicly available threat reports to help improve the security posture of your organization! TLP: White Thre…☆15Jun 5, 2023Updated 2 years ago
- Userland API monitor for threat hunting☆58Mar 4, 2020Updated 6 years ago
- Kaze's openly available CVE vulnerability data.☆16Apr 7, 2025Updated last year
- CISCO configuration guides☆14Feb 16, 2020Updated 6 years ago
- A small threat model for a smart home☆19Oct 8, 2019Updated 6 years ago
- Enhanced-PsExec the GUI edition☆13Sep 8, 2021Updated 4 years ago