A repository of sysmon configuration modules

Place to store our documentation, code samples, etc for public consumption.

Public mirror for win32-pr

The official Windows Driver Kit documentation sources

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Microsoft Copilot for Security is a generative AI-powered security solution that helps increase the efficiency and capabilities of defenders to improve security outcomes at machine speed and scale,…

HoneyPoC: Proof-of-Concept (PoC) script to exploit SIGRed (CVE-2020-1350). Achieves Domain Admin on Domain Controllers running Windows Server 2000 up to Windows Server 2019.

A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies

An example of cross compiling Rust apps to Linux on Windows, with only rustup