Alternatives and similar repositories for AutoRuns

Users that are interested in AutoRuns are comparing it to the libraries listed below

• PSGumshoe / PSGumshoe
  ☆259Updated 8 months ago
• mattifestation / PSSysmonTools
  Sysmon Tools for PowerShell
  ☆230Updated 6 years ago
• jaredcatkinson / PSReflect-Functions
  Module to provide PowerShell functions that abstract Win32 API functions
  ☆248Updated last year
• SadProcessor / SomeStuff
  Some PowerShell Stuff
  ☆281Updated 3 years ago
• realparisi / WMI_Monitor
  Log newly created WMI consumers and processes to the Windows Application event log
  ☆124Updated 7 years ago
• travisfoley / dfirtriage
  Digital forensic acquisition tool for Windows based incident response.
  ☆344Updated last year
• darkoperator / Posh-VirusTotal
  PowerShell Module to interact with VirusTotal
  ☆121Updated 5 years ago
• darkoperator / Posh-Sysmon
  PowerShell module for creating and managing Sysinternals Sysmon config files.
  ☆213Updated 4 years ago
• PowerShellMafia / PowerSCCM
  PowerSCCM - PowerShell module to interact with SCCM deployments
  ☆363Updated 3 years ago
• EricZimmerman / AmcacheParser
  Parses amcache.hve files, but with a twist!
  ☆140Updated 6 months ago
• mattifestation / PSReflect
  Easily define in-memory enums, structs, and Win32 functions in PowerShell
  ☆224Updated 6 years ago
• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆740Updated last year
• netwrix / poshkatz
  PowerShell module for Mimikatz
  ☆213Updated 5 years ago
• jschicht / RawCopy
  Commandline low level file extractor for NTFS
  ☆294Updated 6 years ago
• R3MRUM / PSDecode
  PowerShell script for deobfuscating encoded PowerShell scripts
  ☆425Updated 4 years ago
• EricZimmerman / PECmd
  Prefetch Explorer Command Line
  ☆261Updated 6 months ago
• cyberark / RiskySPN
  Detect and abuse risky SPNs
  ☆263Updated 8 years ago
• cyberark / zBang
  zBang is a risk assessment tool that detects potential privileged account threats
  ☆340Updated 3 years ago
• kavika13 / RemCom
  Remote Command Executor: A OSS replacement for PsExec and RunAs - or Telnet without having to install a server. Take your pick :)
  ☆353Updated 7 years ago
• JoeyRentenaar / Office-365-Extractor
  The Office 365 Extractor is a tool that allows for complete and reliable extraction of the Unified Audit Log (UAL)
  ☆159Updated 2 years ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆316Updated last month
• EricZimmerman / AppCompatCacheParser
  AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
  ☆122Updated 6 months ago
• NetSPI / PowerShell
  NetSPI PowerShell Scripts
  ☆334Updated 6 months ago
• miladaslaner / ThreatHunt
  ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
  ☆135Updated 6 years ago
• Infocyte / PSHunt
  Powershell Threat Hunting Module
  ☆284Updated 8 years ago
• samratashok / Deploy-Deception
  A PowerShell module to deploy active directory decoy objects.
  ☆233Updated 5 years ago
• davidpany / WMI_Forensics
  ☆304Updated 4 years ago
• MHaggis / hunt-detect-prevent
  Lists of sources and utilities utilized to hunt, detect and prevent evildoers.
  ☆166Updated 6 years ago
• kacos2000 / WindowsTimeline
  Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)
  ☆189Updated 2 years ago
• mandiant / flare-wmi
  ☆427Updated 2 years ago