11firefly11/yinghuo

一款轻量级Windows 应急响应辅助工具

Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.

Windows forensics Engine

a windows-ir skill

PowerShell Digital Forensics & Incident Response Scripts.

Rapidly Search and Hunt through Windows Forensic Artefacts

Forensics artefact collection tool for systems running Microsoft Windows