Example Usage
.\RetrievIR.ps1 : Default Usage - collects all artifacts specified in JSON within 'configs' directory from the localhost into the current directory. .\RetrievIR.ps1 -tags sans_triage - Capture most artifacts described in the SANS Triage package within KAPE .\RetrievIR.ps1 -targets HOSTNAME1,HOSTNAME2 : Run RetrievIR against the provided hostnames. .\RetrievIR.ps1 -target_file C:\targets.txt : Run RetrievIR against the line-delimited targets present in the specified text file. .\RetrievIR.ps1 -creds : Tell RetrievIR to prompt the user for credentials to use - by default, RetrievIR runs with the current user context. .\RetrievIR.ps1 -evidence_dir C:\evidence : Tell RetrievIR where to store collected evidence - by default, evidence will be stored in PSScriptRoot\evidence .\RetrievIR.ps1 -config C:\my_config.json : Specify the path to a custom configuration file to use - by default, RetrievIR will look for all JSON files within the 'configs' directory in PSScriptRoot (current executing directory). .\RetrievIR.ps1 -config C:\RetrievIRConfigs : Specify the path to a directory containing 1 or more customer configuration JSON to use - by default, RetrievIR will look for all JSON fil
See also
Volatility Workbench
Free
Free GUI front-end for Volatility 3 memory forensics framework on Windows. Simplifies memory analysi…
ad-privileged-audit
Free
Provides various Windows Server Active Directory (AD) security-focused reports.…
malwaredb-rs
Open Source
MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery…
SingleFileExtractor
Open Source
A tool for extracting contents (assemblies, configuration, etc.) from a single-file application to a…
apiosintDS
Open Source
On demand query API for https://github.com/davidonzo/Threat-Intel project.…
CAPEv2
Free
Malware Configuration And Payload Extraction…