A Digital Forensics framework for Windows PowerShell.

This module tries to enumerate all the persistence techniques implanted on a compromised machine.

A Digital Forensics framework for Windows PowerShell.

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CIM/WMI obviates the need for the installation of a host-based agent. The WMI service is running by default on all versions of Windows.

A Digital Forensics framework for Windows PowerShell.

A cloud forensics module to run threat hunting playbooks on data from Azure and O365

The DFIR-O365RC module will extract logs from the unified audit log (using Exchange Online and Purview), Entra ID Sign In logs, Entra ID Audit Logs, Azure Monitor and Azure DevOps activity logs