Meerkat
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
digital-forensicsforensicsincident-response+2
483
tonyphipps/meerkatA collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
gmh5225/zeropointThis PowerShell script detects indicators of compromise for CVE-2025-53770 — a critical RCE vulnerability in Microsoft SharePoint. Created by…
tiktb8/cve-2022-29072Powershell to mitigate CVE-2022-29072
azuread/azure-ad-incident-response-powershell-moduleThe Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in…
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
zedocun/soc-investigation-powershell-edrfreezeSOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…
ilhamrzr/rar-anomaly-inspectorDefensive PowerShell tool for static inspection of RAR archives and detection of CVE-2025-8088 path traversal anomalies.
gdraperi/remote-bitlocker-encryption-reportPowerShell script to mitigate CVE-2018-12038. The script takes a list of PC as input, gets their BitLocker encryption type remotely, and outputs a…
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
shadowopcode/desckvb-ratFull analysis of a never documented before Remote Access Trojan linked to Pjoao1578 toolchain
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
mandiant/mandiant-azure-ad-investigator
joeavanzato/trawlerPowerShell script helping Incident Responders discover potential adversary persistence mechanisms.
lethal-forensics/collect-memorydumpAutomated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…
paspke/scavenger_scannerDetect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.