CimSweep
A PowerShell suite for remote Windows incident response and hunting using CIM/WMI, requiring no agent deployment.
What is CimSweep?
CimSweep is a PowerShell-based tool suite that uses CIM/WMI to perform remote incident response and threat hunting on Windows systems. It allows security analysts to collect forensic artifacts like registry entries, files, and event logs across networks without installing agents, leveraging native Windows management protocols.
Security analysts, incident responders, threat hunters, and red team operators who need to perform remote forensic collection and reconnaissance on Windows environments.
It provides a lightweight, agentless alternative to traditional endpoint detection tools, enabling rapid data acquisition at scale with minimal footprint and leveraging built-in Windows capabilities that are difficult for attackers to disable.
Overview
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
Use Cases
Best For
- Performing remote incident response across large Windows estates
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
