Trawler
PersistenceSniper
| Trawler | PersistenceSniper | |
|---|---|---|
| 6 | 5 | |
| 289 | 1,810 | |
| - | - | |
| 5.2 | 6.9 | |
| about 1 month ago | about 1 month ago | |
| PowerShell | PowerShell | |
| MIT License | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Trawler
-
Non-SysAdmin Use Cases for PowerShell? Basically, any use cases NOT involving network, RDP, system config, IT/LAN admin type stuff?
I use it for DFIR work - example - https://github.com/joeavanzato/Trawler
- Sharing a tool I developed to help Blue Teamers discover Persistence on Windows - please check it out!
-
User was hacked and sent out malware via their company email however unable to find out how?
Shameless self-promotion to help you hunt for persistence mechanisms on the endpoint itself if it's Windows - https://github.com/joeavanzato/Trawler
- Sharing a new tool I made for aiding my analysis of persistence mechanisms on Windows - Trawler
- Sharing a new tool I'm working on to help discover persistence mechanisms on Windows - similar to PersistenceSniper but with a wider coverage and built-in allow-list/regex scanning mechanisms.
PersistenceSniper
- PersistenceSniper v1.13.0 and in-depth Wiki by @last0x00
- PersistenceSniper: a Powershell script to hunt for persistence techniques used on Windows machines
- PersistenceSniper: Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.
- PersistenceSniper: Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines by @last0x00
What are some alternatives?
Live-Forensicator - Powershell Script to aid Incidence Response and Live Forensics | Bash Script for MacOS Live Forensics and Incidence Response
WinRice - WinRice makes setting up a new Windows device a child's play. Lay back and relax while it does some of the most common things that people usually do to setup a brand new device. It's all automatic. ✨
MemProcFS-Analyzer - MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
PSCalendar - :calendar: A set of PowerShell commands for displaying calendars in the console.
AzureHunter - A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
Wreckfest-eventloop-randomizer - Simple Power-shell-Script, to read and randomize specific eventloop-tracks in wreckfest.
WELA - WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
PSWinReporting - This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.
Win10 - Win 10/11 related research
PSGPPreferences - A way to manage Group Policy Preferences through PowerShell
Power-Response - Powering Up Incident Response with Power-Response
Standalone-PowerShell-Template - This is an example template that has a batch script that downloads the latest version of PowerShell from GitHub, and a batch script to run a PowerShell script with that version of PowerShell.