
Invoke-DumpMDEConfig
PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )
configuration-auditingdefensive-toolsforensics+3
156

PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )

Post-Exploitation EVTX Analyzer for BloodHound Mapping

Zeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…

This is a repo for fetching Applocker event log by parsing the win-event log

Extract useful information from PANOS support file for CVE-2024-3400

Rapidly Search and Hunt through Windows Forensic Artefacts