PowerTriage

2.0.0

PowerTriage Windows CE is a native PowerShell triage script designed for Incident Response (DFIR) and forensic triage on compromised Windows systems.
It focuses on practical live response, low deployment friction, and dependency-free artifact collection in the Community Edition.

Community Edition highlights:
- Native PowerShell: Runs on standard PowerShell 5.1+
- Live Triage: Focused on rapid collection from running Windows hosts
- Broad Coverage: Network, process, persistence, system, browser, cloud, and user artifacts
- Browser Forensics: Chrome, Edge, Firefox, Opera, Brave (history, cookies, extensions, sync status)
- System Triage: Network connections, processes, services, scheduled tasks, registry autoruns
- Structured Output: CSV/TXT artifacts, hashes, and a packaged final collection
- Low Friction: Intended for practical adoption by responders and analysts

The Pro workflow extends this model with advanced capabilities such as offline mounted-volume collection,
chain of custody outputs, executive reporting, and enhanced evidence packaging.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name PowerTriage

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

jdangosto

Copyright

Package Details

Author(s)

Jesus Angosto

Functions

Show-Banner WriteLog WriteHash Set-ArtifactVisible Add-PacketCaptureFilters New-PacketCaptureOutputEntry Get-NetworkInfo Invoke-PacketCapture Get-SmbInfo Get-Autoruns Get-ScheduledTasksInfo Get-FirewallRules Get-ProcessAndHashes Print-ProcessTree Get-Tree Get-USBHistory Get-Evtx PowerShell_Commands Get-LocalGroups Get-EnvVars Get-Services Get-ClipboardContent RecentFiles ActivitiesCache CopyPrefetch RecycleBin Get-DNS Installed_Software Collect-BrowserArtifacts Get-RdpConnections Get-SystemConfig Export-ForensicArtifactsFromVSS Get-CloudStorageArtifacts Get-RemoteAccessArtifacts Get-EmailArtifacts Export-ForensicCatalog Zip-Results

Dependencies

This script has no dependencies.

Release Notes

Major Windows CE update: lightweight dependency-free DFIR triage, full or minimal collection, expanded browser forensics, optional native packet capture, structured CSV/TXT output, and packaged final collection.

FileList

PowerTriage.nuspec
PowerTriage.ps1

Version History

Version	Downloads	Last updated
2.0.0 (current version)	5	7/14/2026
1.1.0	34	3/9/2026
1.0.1	9	3/1/2026
1.0.0	7	3/1/2026