Automation for internal Windows Penetrationtest / AD-Security

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It ca…

A repository of sysmon configuration modules

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made w…

Re-play Security Events

A list of useful Powershell scripts with 100% AV bypass (At the time of publication).

My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team p…

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events…

Practical Windows Forensics Training

PowerShell script for deobfuscating encoded PowerShell scripts

Mike's Powershell Profile (and how to set up Windows console if you've been using *nix for 20 years)

An List of my own Powershell scripts, commands and Blogs for windows Red Teaming.

A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.

Tools for discovery and abuse of COM hijacks

DBC2 (DropboxC2) is a modular post-exploitation tool, composed of an agent running on the victim's machine, a controler, running on any machine, powershell modules, and Dropbox servers as a means o…

Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for th…

Load any Beacon Object File using Powershell!

Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)

Anything Sysmon related from the MSTIC R&D team

PowerShell scripts for Hard Drive forensics and parsing Windows Artifacts