Repository Index

The official PowerShell documentation sources

• powershell
• powershell-documentation
• hacktoberfest

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

Remote Desktop entirely coded in PowerShell.

• remote-control
• powershell
• windows
• rdp

AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.

• powershell
• deployment
• active
• directory

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

• incident-response
• malware-detection
• persistence
• powershell

A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.

• poshc2
• c2
• redteam
• nettitude

Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry settings with ADMX ingestion. View and edit PowerShell script.

• intune
• msal
• powershell-script
• microsoft

The goal of this repository is to document the most common techniques to bypass AppLocker.

• applocker
• bypass
• awl
• rules

Open source documentation for the Azure Architecture Center on Microsoft Learn.

• azure
• architecture
• cloud
• documentation

This repository contains a collection of Agent Skills developed by GudaStudio, enabling seamless collaboration between Claude and other AI models and tools.

Codex skill for removing defensive writing and strengthening prose.

• academic-writing
• codex
• codex-skill
• editing

A Powershell incident response framework

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers

• powershell
• rest
• powershell-core
• windows

TranslatedMultiple windows for Claude Desktop with different APIs at the same time: keep your official Claude subscription in one window and run other windows on custom / third-party APIs (cc-switch). Windows. Run multiple instances of Claude Desktop, with multiple windows using different APIs at the same time (official subscription and third-party APIs working simultaneously).

• anthropic
• cc-switch
• claude
• claude-code

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

This repo contains all currently available Azure Resource Manager templates for Sitecore

• sitecore
• arm-templates

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.