
SharpHide
Tool to create hidden registry keys.
persistence-mechanismspost-exploitationprivilege-escalation+1
490

Tool to create hidden registry keys.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Bash-based Linux persistence detection tool for DFIR investigations. Scans 15+ persistence mechanisms (systemd, cron, kernel modules, SSH,…

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…

PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.