Various commands, tools, techniques that you can use to examine live Windows systems for signs of Compromise or for Threat Hunting.Can also be used to create a baseline for your environment.For the bests results "Run as Administrator" through CMD and Powershell.
☆15Aug 15, 2022Updated 3 years ago
Alternatives and similar repositories for Windows-Forensic-Examination-and-Threat-Hunting
Users that are interested in Windows-Forensic-Examination-and-Threat-Hunting are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Powershell collection designed to assist in Threat Hunting Windows systems.☆27Apr 13, 2018Updated 7 years ago
- Windows log and threat hunting with powershell☆16Dec 11, 2020Updated 5 years ago
- Detection rules and threat hunting queries in Defender XDR and Azure Sentinel☆16Mar 13, 2026Updated last week
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 2 years ago
- Detecting Cobalt Strike Team Servers on targets through traffic telemetry.☆22Aug 13, 2024Updated last year
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.☆21Nov 13, 2022Updated 3 years ago
- Azure AD Incident Response☆27Oct 8, 2021Updated 4 years ago
- PowerShell Script for Agentless Incident Response☆25Apr 5, 2018Updated 7 years ago
- A simple many-rules to many-files YARA scanner for incident response or malware zoos.☆27Jun 3, 2018Updated 7 years ago
- ☆33Dec 4, 2022Updated 3 years ago
- Repo containing all info, scripts, etc. related to CVE-2021-44228☆10Dec 29, 2021Updated 4 years ago
- Zeek scripts that provide an alternative log file logging TLS/SSL traffic☆12May 4, 2021Updated 4 years ago
- Scanner which is capable of scanning multiple hosts or multiple subnets on an SSL port and output a CSV file with the certificate details…☆14Nov 29, 2013Updated 12 years ago
- Repository for my GitHub Universe 2023 session SEC1808M☆10Nov 8, 2023Updated 2 years ago
- NordVPN Special Discount Offer • AdSave on top-rated NordVPN 1 or 2-year plans with secure browsing, privacy protection, and support for for all major platforms.
- A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.☆97May 28, 2023Updated 2 years ago
- Converts exported results of CAPA tool from .json format to another formats supporting by different tools.☆22Feb 15, 2022Updated 4 years ago
- A collection of handy and specific tools for the Red Teamer☆11Aug 13, 2024Updated last year
- scripting IDA like a Pro☆24Oct 27, 2020Updated 5 years ago
- Purpleteam scripts simulation & Detection - trigger events for SOC detections☆196Dec 20, 2024Updated last year
- Proton Drive integration for Home Assistant (compatible with HACS)☆20Mar 18, 2026Updated last week
- A reasonably performant TF-IDF implementation.☆12Nov 20, 2022Updated 3 years ago
- Yara rules☆22Mar 27, 2023Updated 2 years ago
- Penetration Testing Checklist☆37May 14, 2020Updated 5 years ago
- NordVPN Special Discount Offer • AdSave on top-rated NordVPN 1 or 2-year plans with secure browsing, privacy protection, and support for for all major platforms.
- A series of PowerShell scripts to automate collection of forensic artefacts in most Incident Response environments☆65Jan 31, 2022Updated 4 years ago
- Hunt malware with Volatility☆49Mar 3, 2026Updated 3 weeks ago
- A preconfigured Windows-based system designed for rapid forensic investigations in both Azure and AWS.☆38Mar 25, 2024Updated 2 years ago
- A completely unsupported set of scripts used in SANS FOR572, Advanced Network Forensics and Analysis☆28Aug 6, 2025Updated 7 months ago
- Threat Hunt Investigation Methodology and Procedure☆15Jul 11, 2022Updated 3 years ago
- Automatically generated Sysmon parser for Azure Sentinel☆18Jan 6, 2026Updated 2 months ago
- Home Assisstant custom integration to provide data from Samsung SmartThings Find, such as SmartTag locations☆31Jun 11, 2025Updated 9 months ago
- Cloud threat detection visualization from excalidraw☆12Apr 25, 2022Updated 3 years ago
- A Mixture‑of‑Experts Educational Framework for Adaptive Cybersecurity☆22Feb 8, 2026Updated last month
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Repo to track SANS BlueTeam Summit Presentation☆23Oct 4, 2022Updated 3 years ago
- Learn how to get more out of publicly available threat reports to help improve the security posture of your organization! TLP: White Thre…☆15Jun 5, 2023Updated 2 years ago
- Userland API monitor for threat hunting☆58Mar 4, 2020Updated 6 years ago
- Kaze's openly available CVE vulnerability data.☆16Apr 7, 2025Updated 11 months ago
- A small threat model for a smart home☆18Oct 8, 2019Updated 6 years ago
- CISCO configuration guides☆14Feb 16, 2020Updated 6 years ago
- Commands used in Windows penetration tests☆56Jan 19, 2026Updated 2 months ago