1.zoicware / RemoveWindowsAI
Force Remove Copilot, Recall and More in Windows 11
- copilot
- recall
- windows
- ai
- debloat
- powershell
- +9 more
+414 stars
from 13,153 · score 6.03
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
9 repositories by Attention Score · Oct 5, 2026 – Nov 3, 2026 (UTC)
2.mandiant / flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
+198 stars
from 9,085 · score 5.29
3.last-byte / PersistenceSniper
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
- powershell-module
- powershell-script
- +3 more
+13 stars
from 2,138 · score 2.64
4.Badgerati / Pode
Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers
- powershell
- rest
- powershell-core
- windows
- unix
- cross-platform
- +13 more
+11 stars
from 1,061 · score 2.48
5.Yamato-Security / WELA
WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.
+6 stars
from 122 · score 1.95
6.mgeeky / ProtectMyTooling
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
+4 stars
from 1,101 · score 1.61
7.TonyPhipps / Meerkat
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
- purple
- team
- +14 more
+2 stars
from 481 · score 1.10
8.p0w3rsh3ll / AutoRuns
🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.
+1 stars
from 307 · score 0.69
9.mgreen27 / Invoke-LiveResponse
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
- forensics
- incident-response
- +1 more
+1 stars
from 151 · score 0.69