p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
☆251Updated 5 months ago
Related projects: ⓘ
- ☆246Updated 4 months ago
- Sysmon Tools for PowerShell☆229Updated 6 years ago
- Module to provide PowerShell functions that abstract Win32 API functions☆236Updated 3 months ago
- Executes PowerShell from an unmanaged process☆466Updated 8 years ago
- Log newly created WMI consumers and processes to the Windows Application event log☆123Updated 6 years ago
- Some PowerShell Stuff☆281Updated 2 years ago
- PowerShell Obfuscation Detection Framework☆719Updated 9 months ago
- PowerShell module for creating and managing Sysinternals Sysmon config files.☆207Updated 3 years ago
- Detect and abuse risky SPNs☆259Updated 7 years ago
- Parses amcache.hve files, but with a twist!☆115Updated 2 weeks ago
- Prefetch Explorer Command Line☆209Updated last week
- NetSPI PowerShell Scripts☆321Updated 8 months ago
- PowerShell module for Mimikatz☆209Updated 4 years ago
- PowerSCCM - PowerShell module to interact with SCCM deployments☆332Updated 2 years ago
- Lnk Explorer Command line edition!!☆261Updated 3 months ago
- Easily define in-memory enums, structs, and Win32 functions in PowerShell☆215Updated 5 years ago
- PowerShell Module to interact with VirusTotal☆115Updated 4 years ago
- Powershell Threat Hunting Module☆274Updated 7 years ago
- C# based evtx parser with lots of extras☆266Updated 2 weeks ago
- zBang is a risk assessment tool that detects potential privileged account threats☆333Updated 2 years ago
- This repo is for WMIOps, a powershell script which uses WMI for various purposes across a network.☆381Updated 2 months ago
- Commandline low level file extractor for NTFS☆272Updated 5 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆206Updated 5 years ago
- PowerShell Remote Download Cradle Generator & Obfuscator☆817Updated 6 years ago
- ☆415Updated last year
- A PowerShell module to deploy active directory decoy objects.☆220Updated 4 years ago
- Digital forensic acquisition tool for Windows based incident response.☆328Updated 4 months ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆416Updated 3 years ago
- ☆293Updated 4 years ago
- ☆251Updated 2 years ago