lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
rjsudlow/proxynotshell-ioc-checkerScript to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)
intel-xeon/cve-2021-44228---detection-with-powershell
gmh5225/zeropointThis PowerShell script detects indicators of compromise for CVE-2025-53770 — a critical RCE vulnerability in Microsoft SharePoint. Created by…
alexpena5635/cve-2021-44228_scanner-main-modified-
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
ace-responder/cve-2022-47966_checkerRun on your ManageEngine server
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
jangeisbauer/gundoggundog - guided hunting in Microsoft Defender
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
osbornepro/btps-secpackPowerShell-based security toolkit for small-to-medium enterprises, providing automated alerts, Active Directory hardening, Windows Event Forwarding,…
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
mandiant/mandiant-azure-ad-investigator