1
GitHub - mamun-sec/dfirt: Collect information of Windows PC when doing incident...
source link: https://github.com/mamun-sec/dfirt
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
DFIRT (DFIR Tool)
Collect information of Windows PC when doing incident response.
DFIRT is a Powershell script. It collects information of-
- recently used files,
- suspicious Event ID,
- Powershell history for all session,
- files opened directly from Windows Explorer,
- network related running services,
- free space of disk,
- Internet connectivity information,
- safe DLL search mode,
- last boot up time,
- user accounts list from SID,
- computer name, current build, ID,
- current user language settings,
- Windows Defender Status,
- current Admin Approval Mode policy,
- domain,
- non default folders in Program File.
How to use:
1. Download the dfirt.ps1 script.2. Start Windows Powershell.
3. Go to the DFIR folder.
4. Write .\dfirt.ps1 and press Enter.
5. Now, DFIRT will start collecting information and save those information in report.txt file.
Remember
When you will run the script, result will be saved in report.txt file. But, if you again run the script and there is still previously saved report.txt file in the DFIRT folder then, the file will be overwritten with new report.
A message to you:
I will try to continuously add new features to DFIRT. If you wish to add functionality, feel free to contribute here.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK