Alternatives and similar repositories for AutoRuns:

Users that are interested in AutoRuns are comparing it to the libraries listed below

• mattifestation / PSSysmonTools
  Sysmon Tools for PowerShell
  ☆229Updated 6 years ago
• PSGumshoe / PSGumshoe
  ☆256Updated 4 months ago
• EricZimmerman / AmcacheParser
  Parses amcache.hve files, but with a twist!
  ☆130Updated 2 months ago
• travisfoley / dfirtriage
  Digital forensic acquisition tool for Windows based incident response.
  ☆338Updated 10 months ago
• realparisi / WMI_Monitor
  Log newly created WMI consumers and processes to the Windows Application event log
  ☆124Updated 7 years ago
• EricZimmerman / LECmd
  Lnk Explorer Command line edition!!
  ☆295Updated 2 months ago
• EricZimmerman / PECmd
  Prefetch Explorer Command Line
  ☆250Updated 2 months ago
• leechristensen / UnmanagedPowerShell
  Executes PowerShell from an unmanaged process
  ☆486Updated 9 years ago
• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆730Updated last year
• jaredcatkinson / PSReflect-Functions
  Module to provide PowerShell functions that abstract Win32 API functions
  ☆243Updated 9 months ago
• SadProcessor / SomeStuff
  Some PowerShell Stuff
  ☆282Updated 2 years ago
• netwrix / poshkatz
  PowerShell module for Mimikatz
  ☆212Updated 5 years ago
• csababarta / ntdsxtract
  Active Directory forensic framework
  ☆324Updated 3 years ago
• PowerShellMafia / PowerSCCM
  PowerSCCM - PowerShell module to interact with SCCM deployments
  ☆353Updated 3 years ago
• Infocyte / PSHunt
  Powershell Threat Hunting Module
  ☆283Updated 8 years ago
• mandiant / flare-wmi
  ☆427Updated last year
• mattifestation / PSReflect
  Easily define in-memory enums, structs, and Win32 functions in PowerShell
  ☆222Updated 6 years ago
• darkoperator / Posh-Sysmon
  PowerShell module for creating and managing Sysinternals Sysmon config files.
  ☆207Updated 4 years ago
• EricZimmerman / AppCompatCacheParser
  AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
  ☆116Updated 2 months ago
• cyberark / RiskySPN
  Detect and abuse risky SPNs
  ☆260Updated 7 years ago
• danielbohannon / Invoke-CradleCrafter
  PowerShell Remote Download Cradle Generator & Obfuscator
  ☆833Updated 7 years ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆298Updated this week
• RedSiege / WMIOps
  This repo is for WMIOps, a powershell script which uses WMI for various purposes across a network.
  ☆381Updated 9 months ago
• NetSPI / PowerShell
  NetSPI PowerShell Scripts
  ☆330Updated 2 months ago
• davidpany / WMI_Forensics
  ☆302Updated 4 years ago
• beahunt3r / Windows-Hunting
  ☆350Updated 4 years ago
• mandiant / ShimCacheParser
  ☆275Updated last year
• samratashok / Deploy-Deception
  A PowerShell module to deploy active directory decoy objects.
  ☆226Updated 5 years ago
• cyberark / ACLight
  A script for advanced discovery of Privileged Accounts - includes Shadow Admins
  ☆799Updated 5 years ago
• diogo-fernan / ir-rescue
  A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
  ☆479Updated 4 years ago