A Digital Forensics framework for Windows PowerShell.

This module tries to enumerate all the persistence techniques implanted on a compromised machine.

A Digital Forensics framework for Windows PowerShell.

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CIM/WMI obviates the need for the installation of a host-based agent. The WMI service is running by default on all versions of Windows.

A Digital Forensics framework for Windows PowerShell.

A cloud forensics module to run threat hunting playbooks on data from Azure and O365