DFIR

Invoke-LiveResponse

A PowerShell module for responders collecting forensic artifacts from Windows systems over WinRM or through local script execution.

• DFIR
• PowerShell

GitHub repository ↗

Blue Team Hacks - WMI Eventing

Main area: Detection Engineering · 1,139 words · 6 min read

Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.

• DFIR
• PowerShell
• WMI
• Detection

PowerShell Remoting and Incident Response

Main area: DFIR · 1,886 words · 9 min read

Use PowerShell remoting and WinRM for incident response, with setup examples, collection options and operational considerations.

• PowerShell
• DFIR