Powershell
9 Jun 2019
Examine how Office 365 inbox rules can be hidden, how rule properties are modified, and methods for detecting the changes.
29 May 2019
Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.
7 Apr 2019
Build modular live response scripts with Invoke-LiveResponse, including custom collection logic and support for legacy PowerShell.
2 Apr 2018
Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.
18 Feb 2018
Investigate Microsoft BITS job artefacts, collection methods and event logs to identify suspicious transfers and persistence.
14 Jan 2018
Collect live response data and raw files over WinRM with Invoke-LiveResponse and PowerForensics. Covers setup, collection modes and forensic footprint.
14 Jan 2018
A PowerShell module for responders collecting forensic artifacts from Windows systems over WinRM or through local script execution.
3 Apr 2017
Blue Team Hacks - WMI Eventing
Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.
12 Jan 2017
PowerShell Remoting and Incident Response
Use PowerShell remoting and WinRM for incident response, with setup examples, collection options and operational considerations.