Collects live Windows artifacts, evaluates them against built-in detection rules, and tells you whether the host is compromised. One script, no dependencies.
powershell incident-response forensics threat-hunting sigma forensic-analysis yara-rules threat-analysis blue-team mitre-attack forensics-investigations threat-detection threat-response sigma-rules incident-response-plan incident-response-forensics
-
Updated
Aug 24, 2026 - PowerShell