Fernando Tomlinson

PoSh-R2. PowerShell - Rapid Response... For the incident responder in you!

PowerShell. A series of scripts

Invoke-HiveNightmare. PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 version 1809 or newer

AutomatedProfiler. Automated forensics written in PowerShell

Group_Policy. A series of GPO templates

BlueSpectrum. An IOC framework written in PowerShell

Anydesk_Forensics. PowerShell

Invoke-Fail2Ban. PowerShell version of Fail2Ban

Invoke-SRUMDump. A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.

EIF_Parser. Evil Inject Finder Remote Capability and Parser

TeamViewer_Forensics. A series of functions to parse Teamviewer logs to answer specific questions

McAfee_ePO. Custom Queries, Dashboards, and HIPs Rules

PoSh-R2_GUI. GUI version of PoSh-R2

Invoke-AZExplorer. Microsoft Azure Survey

Invoke-GhostLog. Removal of certain event logs within a Windows OS

Hunters_Hub. Custom Splunk App

ConnectWise_Forensics. PowerShell

IIS_Log_Parser. IIS Logs

SkittleGrinder. Linux Log Collector

Invoke-Unbup. Decrypts McAfee quarantine files

EventLog_Parsers. Series of scripts to parse the event log for analysis

Invoke-HAFNIUMCheck.ps1. Script used to identify compromise via CVEs 2021-26855, 26857, 26858, and 27065

RMM_hunt. Google SecOps script to identify remote access tools

UnderTheWire. PowerShell gaming server site

Briefs-and-Guides.

Get-TeamsFiles. Downloads all files that you've ever uploaded to Microsoft Teams

BareMonkey. Volatility plugin parser

YarPoSh. Remoting Capability for Deploying YARA Across an Enterprise

WMI_Watcher. PowerShell

Invoke-ProcessSuspend. Suspending Processes using PS

PoSh-Bitvise-Log-Parser. Parsing Bitvise logs with PowerShell

McAfee_ESM. Custom Dashboards

Invoke-PrinterNightmareResponse. PowerShell

Invoke-HiveDreams. A capability to identify and remediate CVE-2021-36934 (HiveNightmare)

PS_RMM_Hunt. PowerShell

CVE-Checker. Collection of script to check for CVEs

Invoke-HashFinder. Searches for a supplied list of SHA1 or SHA256 hashes on a system. Requires either a file size or creation date that is associated with the binary that the hashes were retrieved from.

PoSh_git. A git-like environment in PowerShell