Repository Index

Six Degrees of Domain Admin

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

• incident-response
• malware-detection
• persistence
• powershell

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers

• powershell
• rest
• powershell-core
• windows

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

• threat
• hunt
• red
• blue

Zero Infrastructure Password Cracking

• cloudtopolis
• cracking
• hashes
• cloud

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Invoke-LiveResponse

• ir
• dfir
• winrm
• liveresponse

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

• powershell
• powershell-module
• grr
• incident-response

Collection of hashcat lists and things.

• hashcat
• hashcat-rules
• hashcat-masks
• password-cracking

PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.

• powershell
• powershell-modules
• incident-response
• containment