Win-PortFwd

Win-PortFwd Powershell script to setup windows port forwarding using native netsh client Install: git clone https://github.com/deepzec/Win-PortFwd.git Usage: .\win-portfwd.ps1 or powershell.exe -noprofile -executionpolicy bypass -file .\win-portfwd.ps1 Example : Note: This script require admin...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

CyberPipe

CyberPipe v5.3 formerly CSIRT-Collect An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations. Functions: 🐏 Capture a memory image with MAGNET DumpIt supports x86, x64, and ARM64 or MAGNET RAM Capture for legacy systems. 💻 Collect triage data using MAGNET...

Invoke-EDRChecker

Invoke-EDRChecker The script will check running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and...

Orchestrated-Powershell-for-CVE-2023-24932-en

Secure Boot Mitigation Orchestrator Script Overview This PowerShell script automates the Secure Boot mitigation steps for CVE-2023-24932 , as outlined in the Microsoft Security Guidance. It handles the entire process, including registry updates, reboots, and event log validation, to ensure your...

CVE-2020-16898_Check

CVE-2020-16898Check Minor powershell script that checks for vulnerable interfaces...

CVE-2022-41099-Fix

I take no Liability & Warranty on this script please fully test before use. CVE-2022-41099-Fix Update WINRE.WIM file to fix CVE-2022-41099 REF: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41099 Microsoft Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=kb5022282...

CVE-2022-47966_checker

CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...

Compromised-Org-Chart-Generator

Compromised Org Chart Generator Overview Active Directory is used by organization as the identity provider. It contains information of all employees including their names, job titles, departments, and their managers. Password audits can help to discover weaknesses and risks. You might try passwor...

MFASweep

MFASweep MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled. Depending on how conditional access policies and other multi-factor authentication settings are configured some...

WinRE-Fix

WinRE-Fix PowerShell script to safely move/recreate Windows Recovery Environment WinRE to a new Recovery partition. Keywords: WinRE Windows Recovery Recovery Partition reagentc KB5034441 KB5028997 CVE-2024-20666 BitLocker Windows Update Fix Partition Resize GPT UEFI 🎯 What This Script Solves This...

antivmdetection

Antivmdetection Background A script to help you create templates, which you can use with VirtualBox to make VM detection harder. My first post on the subject was in 2012 and have after that been updated at random times. The blog format might have not been the best way of publishing the informatio...

Douglas-042

Douglas-042 - Threat Hunting Incident Response - PowerShell Hunting DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the...

Follina-MSDT-Vulnerability-CVE-2022-30190-

Follina-MSDT-Vulnerability-CVE-2022-30190- Detection and Remediation of the Follina MSDT Vulnerability CVE-2022-30190 For detail inormatin about Follina-MSDT-Vulnerability-CVE-2022-30190- visit...

Chrome-and-Edge-Version-Dumper

Chrome-and-Edge-Version-Dumper Powershell script that dumps Chrome and Edge version to a text file in order to determine if you need to update due to CVE-2022-1096 Make sure to edit the paths before using AND make the folder for the output to be stored...

ElectronVulnerableVersion

Find Electron Apps Vulnerable to CVE-2023-4863 / CVE-2023-5129 This PowerShell script downloads Sysinternals Strings, recursively searches for strings within all .exe files across all drives, and compares the Electron version found with known patched versions below to determine vulnerability to...

stop-zenbleed-win

Stopping Zenbleed CVE-2023-20593 on Windows The newly discovered Zenbleed vulnerability CVE-2023-20593 affects all Zen2 processors from AMD. Unfortunately, AMD will not provide microcode updates for many of its processors until November or December 2023. How to stay safe in the meantime? Luckily,...

MoveEdr

MoveEDR If you're admin you can force Windows to delete or move folders and files around immediately after booting before services are started. This can be used to disable EDRs. Usage !CAUTION There is an issue with CrowdStrike which results in a bootloop with the message "INACCESSIBLEBOOTDEVICE"...

FarsightAD

FarsightAD Table of Contents FarsightAD Table of Contents Description Prerequisite Basic usage AD Hunting cmdlets Demo Fully / partially hidden objects detection Acknowledgements Thanks Author Licence Description FarsightAD is a PowerShell script that aim to help uncovering eventual persistence...

DCOMrade

DCOMrade DCOMrade is a Powershell script that is able to enumerate the possible vulnerable DCOM applications that might allow for lateral movement, code execution, data exfiltration, etc. The script is build to work with Powershell 2.0 but will work with all versions above as well. The script...