A Digital Forensics framework for Windows PowerShell.

A Digital Forensics framework for Windows PowerShell.

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CIM/WMI obviates the need for the installation of a host-based agent. The WMI service is running by default on all versions of Windows.

A Digital Forensics framework for Windows PowerShell.

This module tries to enumerate all the persistence methods implanted on a compromised machine. New techniques may take some time before they are implemented in this script, so don't assume that because the module didn't find anything the machine is clean.

A cloud forensics module to run threat hunting playbooks on data from Azure and O365