
VMkatz
Extract Windows credentials directly from VM memory snapshots and virtual disks
digital-forensicsexploitationforensics+7

Extract Windows credentials directly from VM memory snapshots and virtual disks

Cross-platform interactive shell for Microsoft Defender for Endpoint Live Response

PowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.

Powershell Empire Persistence finder

An aggressor script that tracks operational changes made during a red team engagement. Gives you a full audit trail of what was changed and what…