WindowsSecurityAudit
1.6.0
Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories — threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN journal, Sysmon ana
Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories — threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN journal, Sysmon analytics), SIEM integration (Splunk HEC, Microsoft Sentinel, CEF/NDJSON), threat intelligence feeds (abuse.ch, AbuseIPDB, MISP, TAXII/STIX), Active Directory security, hardening baselines and automated remediation. Runs on Windows PowerShell 5.1+ and PowerShell 7. Fully locale-invariant since v1.6.0: all checks use APIs, GUIDs and SIDs instead of parsing localized console output, producing correct results on non-English Windows (Turkish, German, French, ...). Zero external dependencies. Free and open source — support development: https://buymeacoffee.com/okanyildizr
Show more
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 Okan YILDIZ. All rights reserved.
Package Details
Author(s)
- Okan YILDIZ
Tags
Security Audit DFIR ThreatHunting Compliance MITRE IncidentResponse Vulnerability Windows BlueTeam
Dependencies
This module has no dependencies.
Release Notes
FileList
- WindowsSecurityAudit.nuspec
- .github\CODEOWNERS
- .github\FUNDING.yml
- .github\ISSUE_TEMPLATE\bug_report.md
- .github\ISSUE_TEMPLATE\feature_request.md
- .github\workflows\ci.yml
- .github\workflows\publish.yml
- ActiveDirectory\Find-ADBackdoors.ps1
- ActiveDirectory\Find-ADVulnerabilities.ps1
- ActiveDirectory\Find-StaleADObjects.ps1
- ActiveDirectory\Get-ADPasswordPolicy.ps1
- ActiveDirectory\Get-ADPrivilegedAccounts.ps1
- ActiveDirectory\Test-ADSecurityPosture.ps1
- Analysis\Get-EventLogAnalysis.ps1
- Analysis\Get-FileSystemAnalysis.ps1
- Analysis\Get-MemoryAnalysis.ps1
- Analysis\Get-RegistryAnalysis.ps1
- CHANGELOG.md
- CloudSecurity\Get-AzureADRiskySignIns.ps1
- CloudSecurity\Get-CloudComplianceStatus.ps1
- CloudSecurity\Test-M365SecurityPosture.ps1
- Compliance\Export-ComplianceEvidence.ps1
- Compliance\Get-ComplianceReport.ps1
- Compliance\Test-CISBenchmark.ps1
- Compliance\Test-NISTCompliance.ps1
- Compliance\Test-PCI-DSS.ps1
- Core\Compare-SecurityBaseline.ps1
- Core\Get-EventIdDescription.ps1
- Core\Get-SecurityBaseline.ps1
- Core\Get-SystemInfo.ps1
- Core\Test-SystemIntegrity.ps1
- CreateProjectFolderStructure.ps1
- Detection\Find-DefenseEvasion.ps1
- Detection\Find-NetworkAnomalies.ps1
- Detection\Find-PersistenceMechanisms.ps1
- Detection\Find-SuspiciousAuthentication.ps1
- Detection\Find-SuspiciousProcesses.ps1
- Detection\Get-CredentialAccessEvents.ps1
- Detection\Get-SysmonAnalytics.ps1
- Enterprise\Get-MultiSystemAudit.ps1
- Enterprise\Invoke-EnterpriseSecurityScan.ps1
- Enterprise\Invoke-SecurityAssessment.ps1
- Enterprise\Register-ScheduledSecurityScan.ps1
- Forensics\Export-MemoryDump.ps1
- Forensics\Get-ArtifactCollection.ps1
- Forensics\Get-ExecutionArtifacts.ps1
- Forensics\Get-FileSystemJournal.ps1
- Forensics\Get-USBHistory.ps1
- Forensics\Get-UserActivityArtifacts.ps1
- Forensics\New-ForensicTimeline.ps1
- Hardening\Enable-AuditPolicies.ps1
- Hardening\Enable-PowerShellSecurity.ps1
- Hardening\Invoke-SecurityRemediation.ps1
- Hardening\Set-SecurityBaseline.ps1
- LICENSE
- Private\Get-AuditPolicyTable.ps1
- Private\Get-LocalPasswordPolicy.ps1
- Private\Get-WlanProfileList.ps1
- Private\IdentityHelpers.ps1
- README.md
- Reporting\Get-SecurityMetrics.ps1
- Reporting\New-ConsolidatedReport.ps1
- Reporting\New-ExecutiveReport.ps1
- Reporting\New-SecurityDashboard.ps1
- Response\ConvertTo-SiemEvent.ps1
- Response\Export-SecurityReport.ps1
- Response\Invoke-ForensicCollection.ps1
- Response\Invoke-IncidentResponse.ps1
- Response\Send-SiemEvent.ps1
- SECURITY.md
- Test-Module.ps1
- ThreatHunting\Export-AttackNavigatorLayer.ps1
- ThreatHunting\Find-APTIndicators.ps1
- ThreatHunting\Find-DataExfiltration.ps1
- ThreatHunting\Find-LateralMovement.ps1
- ThreatHunting\Find-LivingOffLand.ps1
- ThreatHunting\Get-MITREAttackMapping.ps1
- ThreatHunting\Get-ThreatIntelligence.ps1
- Vulnerability\Find-EOLSoftware.ps1
- Vulnerability\Get-ExposedServices.ps1
- Vulnerability\Get-NVDCveData.ps1
- Vulnerability\Get-SecurityMisconfigurations.ps1
- Vulnerability\Get-VulnerabilityAssessment.ps1
- Vulnerability\Resolve-CpeName.ps1
- Vulnerability\Test-CertificateHealth.ps1
- Vulnerability\Test-PatchCompliance.ps1
- WindowsDefender\Get-DefenderStatus.ps1
- WindowsDefender\Invoke-DefenderScan.ps1
- WindowsDefender\Update-DefenderConfiguration.ps1
- WindowsSecurityAudit.psd1
- WindowsSecurityAudit.psm1
- tests\Locale.Regression.Tests.ps1
- tests\Smoke.Windows.Tests.ps1
- tests\WindowsSecurityAudit.Tests.ps1
- tests\fixtures\auditpol-backup-de.csv
- tests\fixtures\auditpol-backup-en.csv
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.6.0 (current version) | 10 | 10/26/2026 |