PSRecon
A PowerShell script for live forensic data acquisition and endpoint lockdown during Windows incident response.
What is PSRecon?
PSRecon is a PowerShell script for live forensic data acquisition from Windows systems during security incidents. It automates the collection of system data, organizes evidence, and can quarantine compromised hosts to prevent threat spread. The tool generates self-contained HTML reports and supports remote execution for rapid incident response.
Security analysts, incident responders, and IT teams responsible for investigating and containing Windows-based security breaches, especially in environments where rapid evidence collection is critical.
Developers choose PSRecon for its ability to quickly gather and hash forensic data while offering built-in endpoint lockdown features, all within a single PowerShell script that doesn't require centralized infrastructure.
Overview
:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Use Cases
Best For
- Rapid forensic data collection from compromised Windows hosts
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
