Alternatives and similar repositories for WMI_Monitor

Users that are interested in WMI_Monitor are comparing it to the libraries listed below

• mattifestation / PSSysmonTools
  Sysmon Tools for PowerShell
  ☆231Updated 7 years ago
• beahunt3r / Windows-Hunting
  ☆350Updated 4 years ago
• fox-it / danderspritz-evtx
  Parse evtx files and detect use of the DanderSpritz eventlogedit module
  ☆148Updated 7 years ago
• SadProcessor / SomeStuff
  Some PowerShell Stuff
  ☆279Updated 3 years ago
• williballenthin / process-forest
  Reconstruct process trees from event logs
  ☆147Updated 5 years ago
• giMini / NOAH
  PowerShell No Agent Hunting
  ☆109Updated 7 years ago
• cyberark / ketshash
  A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
  ☆172Updated 8 months ago
• gleeda / memtriage
  Allows you to quickly query a Windows machine for RAM artifacts
  ☆220Updated 5 years ago
• MHaggis / hunt-detect-prevent
  Lists of sources and utilities utilized to hunt, detect and prevent evildoers.
  ☆166Updated 6 years ago
• matthewdunwoody / block-parser
  Parser for Windows PowerShell script block logs
  ☆99Updated last year
• JavelinNetworks / IR-Tools
  IR-Tools - PowerShell tools for IR
  ☆130Updated 8 years ago
• MotiBa / Sysmon
  Sysmon configuration
  ☆65Updated 7 years ago
• Cyb3rWard0g / Invoke-ATTACKAPI
  A PowerShell script to interact with the MITRE ATT&CK Framework via its own API
  ☆369Updated 6 years ago
• dwestgard / threat_hunting_tables
  Theat hunting notes in flat file format and mapped to MITRE's ATT&CK IDs
  ☆42Updated 7 years ago
• FixTheExchange / Invoke-ExchangeWebShellHunter
  PowerShell script for hunting webshells on Microsoft Exchange Servers.
  ☆56Updated 8 years ago
• PSGumshoe / PSGumshoe
  ☆261Updated last week
• swisscom / PowerGRR
  PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
  ☆57Updated 3 years ago
• jaredcatkinson / PSReflect-Functions
  Module to provide PowerShell functions that abstract Win32 API functions
  ☆249Updated last year
• mkorman90 / sysmon-config-bypass-finder
  Detect possible sysmon logging bypasses given a specific configuration
  ☆110Updated 6 years ago
• zacbrown / PowerKrabsEtw
  PowerKrabsEtw is a PowerShell interface for doing real-time ETW tracing.
  ☆103Updated 4 years ago
• secabstraction / WmiSploit
  ☆164Updated 10 years ago
• mandiant / ShimCacheParser
  ☆278Updated 2 years ago
• JPCERTCC / DetectLM
  Detecting Lateral Movement with Machine Learning
  ☆139Updated 8 years ago
• gpoguy / GetVulnerableGPO
  PowerShell script to find 'vulnerable' security-related GPOs that should be hardended
  ☆200Updated 7 years ago
• Invoke-IR / Uproot
  Currently not updated for WMIEvent module...
  ☆263Updated 9 years ago
• mandiant / flare-wmi
  ☆427Updated 2 years ago
• olafhartong / detection-sources
  ☆53Updated 6 years ago
• marcosd4h / sysmonx
  SysmonX - An Augmented Drop-In Replacement of Sysmon
  ☆214Updated 6 years ago
• Invoke-IR / ACE
  Automated, Collection, and Enrichment Platform
  ☆325Updated 5 years ago
• williballenthin / python-sdb
  Pure Python parser for Application Compatibility Shim Databases (.sdb files)
  ☆109Updated 4 years ago