PowerSploit - A PowerShell Post-Exploitation Framework

Force Remove Copilot, Recall and More in Windows 11

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

Empire is a PowerShell and Python post-exploitation agent.

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

A Collection of Scripts Which Disable / Remove Windows 10 Features and Apps

Automation for internal Windows Penetrationtest / AD-Security

A repository of sysmon configuration modules

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

Automation to assess the state of your M365 tenant against CISA's baselines

This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

The official PowerShell documentation sources

The goal of this repository is to document the most common techniques to bypass AppLocker.

Place to store our documentation, code samples, etc for public consumption.

Windows Templates for Packer: Windows 11, Windows 10, Windows Server 2022, 2019, 2016, also with Docker

Exchange Server support tools and scripts

A collection of Red Team focused tools, scripts, and notes

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

PowerShell Digital Forensics & Incident Response Scripts.

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

This repo is about Active Directory Advanced Threat Hunting

Timeline of Active Directory changes with replication metadata

An List of my Powershell scripts, commands and Blogs for windows Red Teaming.

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

PowerShell for CrowdStrike's OAuth2 APIs

PowerShell Module that queries Microsoft Graph, and allows for cross-tenant Backup & Restore actions of your Intune Configuration.

a PowerShell module that allows you to impersonate the currently logged on user, while running PowerShell.exe as system.

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework