Tools

lethal-forensics/collect-memorydump

Automated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…

dwmetz/cyberpipe

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

blacksnufkin/invoke-dumpmdeconfig

PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )

qazeer/farsightad

PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain…

suuhm/cve-2026-21509-handler

PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office…

ridsoliveira/fix-cve-2023-36884

PowerShell script to apply Microsoft's recommended registry-based workaround for CVE-2023-36884, mitigating remote code execution risk on Windows…

irissentinel/cve-2021-36934

PowerShell script to detect and remediate the CVE-2021-36934 HiveNightmare privilege escalation vulnerability on Windows 10 by checking SAM hive…

gdraperi/remote-bitlocker-encryption-report

PowerShell script to mitigate CVE-2018-12038. The script takes a list of PC as input, gets their BitLocker encryption type remotely, and outputs a…

mingchen-script/cve-2020-1472-visualizer

PowerShell script to scan Windows Event Logs for CVE-2020-1472 indicators (events 5827-5831), export to CSV, and generate Excel pivot tables for…

planetoid/cve-2026-21509-mitigation

PowerShell script that applies a temporary registry-based mitigation for CVE-2026-21509, a Microsoft Office security feature bypass, with backup and…

bjbakker1984/yellowkey-mitigation

PowerShell script that automates the WinRE mitigation workflow for CVE-2026-45585, with verification steps and conditional commit to avoid…

gmh5225/zeropoint

This PowerShell script detects indicators of compromise for CVE-2025-53770 — a critical RCE vulnerability in Microsoft SharePoint. Created by…

im007/cve-2023-23397

PowerShell script to detect and remediate CVE-2023-23397 privilege escalation vulnerability in Microsoft Outlook and Exchange environments.

digital-dev/log4j-cve-2021-44228-remediation

This powershell script is intended to be used by anyone looking to remediate the Log4j Vulnerability within their environment. It can target multiple…

g-gill24/winre-patch

PowerShell script to patch CVE-2022-41099 in the Windows Recovery Environment, mitigating a privilege escalation vulnerability.

soteria-security/hafnium-ioc

A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865

emrekybs/douglas-042

Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…