{"repo":"Bert-JanP/Incident-Response-Powershell","free":true,"listed":false,"github":"https://github.com/Bert-JanP/Incident-Response-Powershell","clone":"git clone https://github.com/Bert-JanP/Incident-Response-Powershell.git","description":"PowerShell Digital Forensics & Incident Response Scripts.","language":"PowerShell","stars":809,"topics":["forensics-tools","incident-response","powershell"],"license":"BSD-3-Clause","category":"cli-tools","readme_excerpt":"Powershell Digital Forensics & Incident Response This repository provides PowerShell-based Incident Response scripts. DFIR Script The DFIR-Script.ps1 script collects forensic artifacts on Windows devices. Key features include: - Collecting over 25 potential indicators of compromise. - CSV-based export files for SIEM integration. - Defender for Endpoint Live Response integration. Granular Response Scripts These scripts perform specific tasks, such as collecting Windows Security Events, resetting active user sessions, or uploading a folder to Azure Storage Blob. Some scripts use APIs to retrieve or export data, with required permissions described in each script. The scripts are structured for the Incident Response cycle: Phase Description -------- ------------- Acquisition Scripts and tools for acquiring data and evidence during an incident. Analysis Sripts for analyzing acquired data to identify indicators of compromise and understand the scope of the incident. Containment Scripts and methods for containing the incident to prevent further damage and spread. Related Blogs: - Incident Response Part 3: Leveraging Live Response - Incident Response PowerShell V2 DFIR Script Usage DFIR Script - Extracted Artefacts The DFIR script collects information from multiple sources and structures the output in the current directory in a folder named 'DFIR- hostname - year - month - date '. This folder is zipped at the end, so that folder can be remotely collected. This script can also be used","default_branch":null,"files":null,"tree":[],"storefront":"/r/Bert-JanP","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Bert-JanP/Incident-Response-Powershell/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}