AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
The LOLBAS project is a curated dataset of Windows binaries, scripts, and libraries that can be abused for malicious purposes (Living Off The Land Binaries and Scripts). Each entry is documented in YAML files with a standardized schema, including technical details, use cases, MITRE ATT&CK mappings, detection artifacts, and external references. The repository serves as a threat intelligence resource for offensive security research and defensive security operations, enabling threat hunting and detection rule development. Data is organized by file type (binaries, libraries, scripts) and maintained through community contributions with automated validation via Pydantic schemas.
This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
WDExtract is a command-line utility for extracting and analyzing Windows Defender/Virus Definition files. It processes VDM (Virus Definition Module) containers and MRT.exe (Malicious Removal Tool) files to extract embedded data, including PE executables, DLLs, and security signatures. The tool can also merge base VDM files with their delta updates and extract raw RMDX containers without further processing. Built with C++ and Windows API, it uses zlib for decompression and implements custom logic for parsing PE files, applying VCDIFF delta patches, and extracting resources from PE files. The application is actively maintained with recent commits and uses GitHub Actions for Windows-based builds.
LSA Whisperer BOF is a Cobalt Strike Beacon Object File (BOF) port of Evan McBroom's LSA Whisperer tool, enabling red team operators to interact with Windows authentication packages (MSV1_0, Kerberos, CloudAP) through legitimate LSA client APIs (LsaCallAuthenticationPackage). It recovers DPAPI credential keys (including under Credential Guard), dumps Kerberos tickets as base64 .kirbi blobs, performs selective ticket purging, extracts Entra ID/AD FS SSO cookies, and generates NTLMv1 responses for hash cracking—all without opening handles to LSASS or touching process memory. The architecture comprises three independent BOF modules (msv1_0, kerberos, cloudap) sharing a common LSA communication layer and comprehensive header definitions for undocumented LSA structures. The code is well-structured, handles privilege separation (untrusted vs. trusted LSA connections), and provides detailed error messages. It targets red team operations and requires Cobalt Strike for execution.
Outpacket is a comprehensive cheatsheet/reference guide that maps traditional impacket penetration testing workflows to modern alternative tools like gopacket, Titanis, NetExec, and others. It serves as a static documentation resource for security professionals working with Windows environments, particularly Active Directory attacks. The repository contains only a single README.md file organized into sections covering authentication, remote execution, Kerberos operations, SMB/file operations, credential dumping, enumeration, AD/LDAP operations, auth coercion, certificate attacks, and exotic credential harvesting techniques. Each section provides command examples for multiple tools alongside explanatory notes about tool-specific behaviors and limitations.
BeaKer is a self-contained threat-hunting deployment for Windows network beacon detection. It provisions an Elasticsearch/Kibana backend with Docker Compose, configures Windows endpoints via a PowerShell agent installer, and ships prebuilt index templates, ingest pipelines, and Kibana dashboards for Sysmon event data. The dominant character is an application/infrastructure project: the core artifacts are deployment scripts, Ansible playbooks, and ELK configuration rather than a library or data analysis framework. A secondary data-pipeline nature is visible in the Elasticsearch ingest pipelines that normalize Windows Security/PowerShell/Sysmon events into ECS, and in the export/import tooling for dashboards and indices.