1.zoicware / RemoveWindowsAI
Force Remove Copilot, Recall and More in Windows 11
- copilot
- recall
- windows
- ai
- debloat
- powershell
- +9 more
+2,212 stars
from 11,355 · score 7.70
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
11 repositories by Attention Score · May 8, 2026 – Nov 3, 2026 (UTC)
2.Atlas-OS / Atlas
🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability.
+1,821 stars
from 20,189 · score 7.51
3.mandiant / flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
+730 stars
from 8,553 · score 6.59
4.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
- powershell-module
- powershell-script
- +3 more
+50 stars
from 2,101 · score 3.93
5.Badgerati / Pode
Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers
- powershell
- rest
- powershell-core
- windows
- unix
- cross-platform
- +13 more
+43 stars
from 1,029 · score 3.78
6.mgeeky / ProtectMyTooling
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
+41 stars
from 1,064 · score 3.74
7.Yamato-Security / WELA
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
+33 stars
from 95 · score 3.53
8.p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
+16 stars
from 292 · score 2.83
9.gfoss / PSRecon
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
+5 stars
from 489 · score 1.79
10.JoelGMSec / Cloudtopolis
Zero Infrastructure Password Cracking
+3 stars
from 415 · score 1.39
11.TonyPhipps / Meerkat
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
- purple
- team
- +14 more
+2 stars
from 481 · score 1.10