Cheat sheet with common enumeration and attack methods for Windows Active Directory.
#windows tools
86 results
A tool designed to extract additional value from enterprise-wide AppCompat / AmCache data
APT Simulator is a tool for simulating a compromised system on Windows.
A comprehensive utility that shows what programs are configured to run during system bootup or login, and when you start various built-in Windows applications.
Microsoft BitLocker is a full volume encryption feature in Windows for protecting data on lost or stolen devices, with tools and resources for implementation.
A project with Terraform and Ansible scripts to create an orchestrated BlueTeam Lab for testing attacks and forensic artifacts on Windows environment.
Semi-tethered jailbreak for iPhone 5s to iPhone X, running iOS 12.0 and up, using the 'checkm8' bootrom exploit.
A Cross-Platform Forensic Framework for Google Chrome that allows investigation of history, downloads, bookmarks, cookies, and provides a full report.
CimSweep is a suite of CIM/WMI-based tools for incident response and hunting operations on Windows systems without the need to deploy an agent.
A wrapper around jNetPcap for packet capturing with Clojure, available for Linux and Windows.
CrowdStrike Falcon Orchestrator is a Windows-based application for workflow automation and security response.
A browser with XSS detection capabilities
CyLR is a Live Response Collection tool for quickly and securely collecting forensic artifacts from hosts with NTFS file systems.
Darkarmour is a Windows AV evasion tool that helps bypass antivirus software, allowing for the creation of undetectable malware.
An open-source modern Dependency Walker for Windows developers.
A lab designed for defenders to quickly build a Windows domain pre-loaded with security tooling and best practices in system logging configurations.
DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.
A tool that exposes the functionality of the Volume Shadow Copy Service (VSS) for creation, enumeration, and manipulation of volume shadow copies, with features for persistence and evasion.
Drltrace is a dynamic API calls tracer for Windows and Linux applications.
DueDLLigence is an open-source tool for identifying and analyzing DLL hijacking vulnerabilities in Windows applications, providing automated analysis and remediation guidance.
Search engine for Windows executable files and hashes, providing insights into file prevalence, behavior, and security information.
A next generation version of enum4linux with enhanced features for enumerating information from Windows and Samba systems.
A repository providing guidance on collecting security-relevant Windows event logs using Windows Event Forwarding (WEF).
A modern tool for Windows kernel exploration and observability with a focus on security.
Load more tools
Showing 24 of 86