z9
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
forensicslog-analysismalware-analysis+2
68
sh1n0g1/z9Detects PowerShell-based malware artifacts from event logs and performs static analysis on PowerShell scripts to identify malicious activity.
emrekybs/douglas-042Triages a suspect Windows machine in minutes. Collects processes, services, autoruns, event logs and forensic artifacts, flags attacker activity, and…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
zedocun/soc-investigation-powershell-edrfreezeSOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated…
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
zach115th/toolshellfinderScans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
mandiant/mandiant-azure-ad-investigatorRead-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
paspke/scavenger_scannerDetect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows
spinfosecurity/bas-guardianFree BACnet/BMS vulnerability scanner for building automation systems. Detects CVE-2026-3611 (CVSS 10.0), CVE-2026-24060, and exposed HVAC/BAS…
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
intrudify/mini-shai-hulud-scannerScanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts,…
jangeisbauer/gundoggundog - guided hunting in Microsoft Defender
rjsudlow/proxynotshell-ioc-checkerScript to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)
ace-responder/cve-2022-47966_checkerRun on your ManageEngine server
shadowopcode/desckvb-ratFull analysis of a never documented before Remote Access Trojan linked to Pjoao1578 toolchain
cyb3rward0g/invoke-attackapiA PowerShell script to interact with the MITRE ATT&CK Framework via its own API
cyprianatsyor/letsdefend-cve-2022-41082-exploitation-attemptDetailed incident report and educational analysis of CVE-2022-41082 (ProxyNotShell) exploitation attempt on Microsoft Exchange Server, including…