Skip to content

Latest commit

 

History

History
87 lines (76 loc) · 2.11 KB

README.md

File metadata and controls

87 lines (76 loc) · 2.11 KB
Raw

PSGumshoe

PSGumshoe is a Windows PowerShell module for the collection of OS and domain artifacts for the purposes of performing live response, hunt, and forensics.

The module focuses on being as forensically sound as possible using existing Windows APIs to achieve the collection of information from the target host.

Functions

Volatile information functions

  • Get-InjectedThread
  • Get-NamedPipe
  • Measure-CharacterFrequency
  • Measure-DamerauLevenshteinDistance
  • Measure-VectorSimilarity
  • Stop-Thread

Directory Service functions

  • Get-DSForest
  • Get-DSDirectoryEntry
  • Get-DSDirectorySearcher
  • Get-DSComputer
  • Get-DSDomain
  • Get-DSGpo
  • Get-DSUser
  • Get-DSGroup*
  • Get-DSReplicationAttribute
  • Get-DSGroupMember
  • Get-DSOU
  • Get-DSTrust
  • Get-DSObjectAcl

Eventlog functions

  • Get-EventPsEngineState
  • Get-EventPsPipeline
  • Get-EventPsIPC
  • Get-EventPsScriptBlock
  • Get-WinEventBaseXPathFilter
  • Get-SysmonProcessAccess
  • Get-SysmonConfigChange
  • Get-SysmonConnectNamedPipe
  • Get-SysmonCreateNamedPipe
  • Get-SysmonCreateRemoteThreadEvent
  • Get-SysmonDriverLoadEvent
  • Get-SysmonFileCreateEvent
  • Get-SysmonFileStreamHash
  • Get-SysmonFileTime
  • Get-SysmonImageLoadEvent
  • Get-SysmonNetworkConnect
  • Get-SysmonProcessCreateEvent
  • Get-SysmonProcessTerminateEvent
  • Get-SysmonRawAccessRead
  • Get-SysmonRegistryKey
  • Get-SysmonRegistryRename
  • Get-SysmonRegistrySetValue
  • Get-SysmonServiceStateChange
  • Get-SysmonWmiBinding
  • Get-SysmonWmiConsumer
  • Get-SysmonWmiFilter
  • Get-SysmonDNSQuery
  • Get-SysmonProcessActivityEvent
  • Get-EventSystemLogon
  • Get-EventSystemLogoff
  • Get-EventTerminalLogon
  • Get-EventTerminalLogoff
  • Get-EventScheduledTaskStart
  • Get-EventScheduledTaskProcess
  • Get-EventScheduledTaskStop
  • Get-EventScheduledTaskComplete
  • Get-EventBitsTransferComplete
  • Get-EventBitsTransferStart
  • Get-SysmonAccessMask
  • Get-SysmonRuleHash
  • ConvertTo-SysmonRule
  • Get-EventProcessCreate
  • Clear-WinEvent
  • Export-WinEvent

CIM Functions

  • Get-CimLogonSession
  • Get-CimProcessLogonSession
  • Get-CimProcess
  • Get-CimComputerInfo
  • Get-CimDNSCache*