A cloud forensics module to run threat hunting playbooks on data from Azure and O365

A comprehensive PowerShell toolkit for threat hunting, digital forensics, and incident response (DFIR). Provides "Hunt" functions to detect persistence mechanisms, analyze system artifacts, search event logs, and generate detailed forensic reports.

Comprehensive Windows security audit and DFIR toolkit: 72 functions across 14 categories — threat hunting (MITRE ATT&CK mapping, lateral movement, LOLBins, data exfiltration), compliance (CIS Benchmark, NIST 800-53, PCI-DSS), vulnerability management (NVD CVE matching, CPE resolution, EOL software), forensics (artifact collection, memory dumps, USN... More info

Enumerates all known Windows autostart / persistence locations (everything Sysinternals Autoruns covers plus COM hijacks, UAC bypass hijacks, PowerShell profiles, browser extensions, BITS, hidden scheduled tasks and more) and maps every entry to MITRE ATT&CK. Pure PowerShell, no external binaries.

Incident response for Microsoft 365 / Entra ID: hunts one tenant or a list for an incident's indicators (vendor app service principals, roles, new credentials, directory audits, sign-ins from IOC IPs) and writes a severity-sorted report with raw evidence. Ships the October 2026 ConnectWise SkyKick indicator set. Windows PowerShell 5.1 compatible.