Hexastrike/PyrsistenceSniper

Rapidly Search and Hunt through Windows Forensic Artefacts

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

PowerShell Digital Forensics & Incident Response Scripts.

Forensics artefact collection tool for systems running Microsoft Windows

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)