WiredPulse/McAfee_ESM

Stars
1
Language
Created about 8 years ago
Updated about 8 years ago

WiredPulse/McAfee_ESM

WiredPulse

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Custom Dashboards

PoSh-R2

PowerShell - Rapid Response... For the incident responder in you!

PowerShell

A series of scripts

Invoke-HiveNightmare

PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer

AutomatedProfiler

Automated forensics written in PowerShell

Group_Policy

A series of GPO templates

BlueSpectrum

An IOC framework written in PowerShell

Anydesk_Forensics

Invoke-SRUMDump

A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.

Invoke-Fail2Ban

PowerShell version of Fail2Ban

TeamViewer_Forensics

A series of functions to parse Teamviewer logs to answer specific questions

EIF_Parser

Evil Inject Finder Remote Capability and Parser

McAfee_ePO

Custom Queries, Dashboards, and HIPs Rules

PoSh-R2_GUI

GUI version of PoSh-R2

Hunters_Hub

Custom Splunk App

Invoke-AZExplorer

Microsoft Azure Survey

Invoke-GhostLog

Removal of certain event logs within a Windows OS

Invoke-Unbup

Decrypts McAfee quarantine files

IIS_Log_Parser

ConnectWise_Forensics

SkittleGrinder

Linux Log Collector

EventLog_Parsers

Series of scripts to parse the event log for analysis

Invoke-HAFNIUMCheck.ps1

Script used to identify compromise via CVEs 2021-26855, 26857, 26858, and 27065

UnderTheWire

PowerShell gaming server site

Briefs-and-Guides

Invoke-ProcessSuspend

Suspending Processes using PS

YarPoSh

Remoting Capability for Deploying YARA Across an Enterprise

WMI_Watcher

BareMonkey

Volatility plugin parser

Invoke-PrinterNightmareResponse

PoSh_git

A git-like environment in PowerShell

Invoke-HiveDreams

A capability to identify and remediate CVE-2021-36934 (HiveNightmare)

PoSh-Bitvise-Log-Parser

Parsing Bitvise logs with PowerShell

CVE-Checker

Collection of script to check for CVEs

Invoke-HashFinder

Searches for a supplied list of SHA1 or SHA256 hashes on a system. Requires either a file size or creation date that is associated with the binary that the hashes were retrieved from.