
ADFT
Active Directory Forensic Toolkit : Detect & reconstruct AD attacks from Windows event logs (EVTX)
configuration-auditingdigital-forensicsforensics+3

Active Directory Forensic Toolkit : Detect & reconstruct AD attacks from Windows event logs (EVTX)

Read-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…