Set-AuditRule

Set-AuditRule A repository of useful access control entries ACE that could be added to the system access control list SACL of a securable object's security descriptor to monitor potential adversarial activity. These entries are categorized by specific securable objects such as files, registry key...

youzer

youzer Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords...

CVE-2021-34470scanner

CVE-2021-34470scanner A Powrshell script to scan for CVE-2021-34470...

BootHoleFix

Boot Hole Fix This script will remediate the BootHole bug identified in CVE-2020-25632 and/or CVE-2021-20233. On July 29, 2020, Microsoft published security advisory 200011 that describes a new vulnerability that's related to Secure Boot. Devices that trust the Microsoft third-party Unified...

checkvulnCVE20205902

checkvulnCVE20205902 A powershell script to check vulnerability CVE-2020-5902 of ip list The instructions there are in the code Keep security!...

Invoke-CVE-2022-22965-SafeCheck

Invoke-CVE-2022-22965-SafeCheck PowerShell port of CVE-2022-22965 by colincowie's original python version. Install: iexiwr https://raw.githubusercontent.com/daniel0x00/Invoke-CVE-2022-22965-SafeCheck/main/Invoke-CVE202222965-SafeCheck.ps1 -UseBasicParsing.content Usage: Injects file...

VMwareCloak

VMwareCloak A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection A high-performance PowerShell 7+ script for scanning IIS logs to detect signs of exploitation related to ToolShell , specifically targeting the zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint. This...

Yellowkey-mitigation

Yellowkey-mitigation.ps1 is a PowerShell script that automates the WinRE mitigation workflow described in CVE-2026-45585, adds verification after every step, and does not execute step 6 reagentc /disable + reagentc /enable if any earlier step fails. It also checks whether the required registry...

Compromised-Org-Chart-Generator

Compromised Org Chart Generator Overview Active Directory is used by organization as the identity provider. It contains information of all employees including their names, job titles, departments, and their managers. Password audits can help to discover weaknesses and risks. You might try passwor...

quick-fix-cve-2024-38063

quick-fix-cve-2024-38063 quick powershell script to fix cve-2024-38063 Donation if you want to support my works, you can donate me at the following monero address: 4B9WQivaHfd3miDfPKEfCianocGpBx9d8FXycz2vmNW3aBDVKHgkBd9Gmapt4RBVEpTwnehujsiUBBehUiLvnEHs7VFstCC Or using PayPal:...

CVE-2023-23397-Patch

CVE-2023-23397 Windows Update Patch CVE-2023-23397 powershell patch script for Windows 10 and 11 This version of the script allows you to check if your device has the most reach sent patches for the latest Microsoft exploit. if the security updates are not found using the Powershell Command...

Search-log4Jvuln-AppScanSTD

Search log4J vuln using AppScan Standard and a list of websites This Powershell script run AppScan Standard scans against a list of web sites URLs.txt checking just for Log4J CVE-2021-44228 vulnerability. Structure of project: After run the script, it will read each line in URLs.txt and start...

Invoke-ATTACKAPI

Invoke-ATTACKAPI DEPRECATED WE RECOMMEND TO USE: https://github.com/Cyb3rWard0g/ATTACK-Python-Client A PowerShell script to interact with the MITRE ATT&CK Framework via its own API in order to gather information about techniques, tactics, groups, software and references provided by the MITRE ATT&...

Scan_GhostScript

ScanGhostScript Scan for GhostScript files affected to CVE-2023-36664 PowerShell is self elevating. You can run it directely via context menu...

HAFNIUM-IOC

HAFNIUM-IOC Hafnium-IOC is a simple PowerShell script that runs on Exchange servers to identify indicators of compromises IOCs from the Hafnium activity release by Mircosoft on 2021-03-02 https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/. The script may be...

CVE-2020-16898_Workaround

CVE-2020-16898Workaround PowerShell Script Workaround for VCE-220-16898 vulnerability...

CVE-2013-3900-Remediation-Script

CVE-2013-3900 Remediation Script Define registry paths for both 32-bit and 64-bit configurations $regPaths = @ "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config", "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" Function to add or update the registry key function...

Sherlock

Deprecated. Have a look at Watson instead. Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. Currently looks for: MS10-015 : User Mode to Ring KiTrap0D MS10-092 : Task Scheduler MS13-053 : NTUserMessageCall Win32k Kernel Pool...

Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...