{"id":13577406,"url":"https://github.com/TonyPhipps/Meerkat","last_synced_at":"2025-04-05T11:32:43.057Z","repository":{"id":44372720,"uuid":"120753048","full_name":"TonyPhipps/Meerkat","owner":"TonyPhipps","description":"A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.","archived":false,"fork":false,"pushed_at":"2024-04-05T17:30:26.000Z","size":737,"stargazers_count":417,"open_issues_count":0,"forks_count":83,"subscribers_count":31,"default_branch":"master","last_synced_at":"2024-04-05T18:36:05.315Z","etag":null,"topics":["analysis","baseline","blue","forensics","hunt","incident","log","monitor","purple","recon","red","response","scan","security","siem","soc","team","threat","threat-hunting","triage"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TonyPhipps.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2018-02-08T11:30:32.000Z","updated_at":"2024-04-15T15:58:56.131Z","dependencies_parsed_at":"2023-02-10T04:30:41.430Z","dependency_job_id":"830d92ed-c09e-42ee-8c11-14cd7646b3e4","html_url":"https://github.com/TonyPhipps/Meerkat","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TonyPhipps%2FMeerkat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TonyPhipps%2FMeerkat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TonyPhipps%2FMeerkat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TonyPhipps%2FMeerkat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TonyPhipps","download_url":"https://codeload.github.com/TonyPhipps/Meerkat/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247331716,"owners_count":20921843,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","baseline","blue","forensics","hunt","incident","log","monitor","purple","recon","red","response","scan","security","siem","soc","team","threat","threat-hunting","triage"],"created_at":"2024-08-01T15:01:21.162Z","updated_at":"2025-04-05T11:32:42.739Z","avatar_url":"https://github.com/TonyPhipps.png","language":"PowerShell","funding_links":[],"categories":["IR Tools Collection","Endpoint","PowerShell","IR tools Collection"],"sub_categories":["Windows Evidence Collection","Forensics"],"readme":"# Meerkat\n![Meerkat Logo](https://i.imgur.com/7gHUYBh.png)\n\n\nMeerkat is collection of PowerShell modules designed for artifact gathering and reconnaissance of Windows-based endpoints without requiring a pre-deployed agent. Use cases include incident response triage, threat hunting, baseline monitoring, snapshot comparisons, and more.\n\n# Artifacts\n|    [Host Info](https://github.com/TonyPhipps/Meerkat/wiki/Computer)    |                       Net Adapters                        | [Processes](https://github.com/TonyPhipps/Meerkat/wiki/Processes)* |       [Services](https://github.com/TonyPhipps/Meerkat/wiki/Services)        |        [Files](https://github.com/TonyPhipps/Meerkat/wiki/Files)        |\n| :--------------------------------------------------------------------: | :-------------------------------------------------------: | :----------------------------------------------------------------: | :--------------------------------------------------------------------------: | :---------------------------------------------------------------------: |\n| [Audit Policy](https://github.com/TonyPhipps/Meerkat/wiki/AuditPolicy) |                  Windows Firewall Rules                   |      [DLLs](https://github.com/TonyPhipps/Meerkat/wiki/DLLs)*      |     [Local Users](https://github.com/TonyPhipps/Meerkat/wiki/LocalUsers)     |                                   ADS                                   |\n|                                 Disks                                  | [Ports](https://github.com/TonyPhipps/Meerkat/wiki/Ports) |                              Strings*                              |    [Local Groups](https://github.com/TonyPhipps/Meerkat/wiki/LocalGroups)    |  [Recycle Bin](https://github.com/TonyPhipps/Meerkat/wiki/RecycleBin)   |\n|                                Hotfixes                                |                            ARP                            |                              Handles*                              | [Scheduled Tasks](https://github.com/TonyPhipps/Meerkat/wiki/ScheduledTasks) |                               Hosts File                                |\n|                                  TPM                                   |   [DNS](https://github.com/TonyPhipps/Meerkat/wiki/DNS)   |                              EnvVars                               |       [Autoruns](https://github.com/TonyPhipps/Meerkat/wiki/Autoruns)        | [Certificates](https://github.com/TonyPhipps/Meerkat/wiki/Certificates) |\n|                                Software                                |                        Net Routes                         |                              Sessions                              |                                  Bitlocker                                   | [Select Registry](https://github.com/TonyPhipps/Meerkat/wiki/Registry)  |\n|                                Hardware                                |                          Shares                           |                         Domain Information                         |                                   Defender                                   |   [Event Logs](https://github.com/TonyPhipps/Meerkat/wiki/EventLogs)    |\n|     [Drivers](https://github.com/TonyPhipps/Meerkat/wiki/Drivers)      |                                                           |                             USBHistory                             |                             Event Logs Metadata                              |                    Events Related to Login Failures                     |\n|                                                                        |                                                           |                                                                    |                                                                              |                 Events Related to User/Group Management                 |\n|                                                                        |                                                           |                                                                    |                                                                              |                           Event Logs Metadata                           |\n\n* Ingest using your SIEM of choice (_Check out the [SIEM](https://github.com/TonyPhipps/SIEM) Repository!_)\n______________________________________________________\n\n## Index\n\n  * [Quick Start](#Quick-Start)\n  * [Usage](#Usage)\n  * [Analysis](#Analysis)\n  * [Troubleshooting](#Troubleshooting)\n  * [Screenshots](#Screenshots)\n  * [Similar Projects](#Similar-Projects)\n  \n______________________________________________________\n\n## Quick Start\n\n### Requirements\n\n* Requires Powershell 5.0 or above on the \"scanning\" device.\n* Requires Powershell 3.0 or higher on target systems. You can make this further backward compatible to PowerShell 2.0 by replacing instances of \"Get-CIMinstance\" with \"Get-WMIObject\"\n* Requires [WinRM access](https://github.com/TonyPhipps/Powershell/blob/master/Enable-WinRM.ps1).\n\n### Install with [Git](https://gitforwindows.org/)\n\nIn a Command or PowerShell console, type the following...\n\n```\ngit clone \"https://github.com/TonyPhipps/Meerkat\" \"C:\\Program Files\\WindowsPowerShell\\Modules\\Meerkat\"\n```\n\nTo update...\n\n```\ncd C:\\Program Files\\WindowsPowerShell\\Modules\\Meerkat\ngit pull\n```\n\n### Install with PowerShell\n\nCopy/paste this into a PowerShell console\n\n```\n$Modules = \"C:\\Program Files\\WindowsPowerShell\\Modules\\\"\nNew-Item -ItemType Directory $Modules\\Meerkat\\ -force\nInvoke-WebRequest https://github.com/TonyPhipps/Meerkat/archive/master.zip -OutFile $Modules\\master.zip\nExpand-Archive $Modules\\master.zip -DestinationPath $Modules\nCopy-Item $Modules\\Meerkat-master\\* $Modules\\Meerkat\\ -Force -Recurse\nRemove-Item  $Modules\\Meerkat-master -Recurse -Force\n```\n\nTo update, simply run the same block of commands again.\n\nFunctions can also be used by opening the .psm1 file and copy-pasting its entire contents into a PowerSell console.\n\n## Run Meerkat\n\nThis command will output results to C:\\Users\\YourName\\Meerkat\\\n\n```\nInvoke-Meerkat\n```\n\nNOTE: The following modules will not return results if not ran with Administrative privileges\n\n- AuditPolicy\n- Drivers\n- EventsLoginFailures\n- Hotfixes\n- RegistryMRU\n- Registry\n- Processes\n- RecycleBin\n\n## Analysis\n\nAnalysis methodologies and techniques are provided in the [Wiki pages](https://github.com/TonyPhipps/Meerkat/wiki).\n\n## Troubleshooting\n[Installing a Powershell Module](https://learn.microsoft.com/en-us/powershell/scripting/developer/module/installing-a-powershell-module?view=powershell-7.2)\n\nIf your system does not automatically load modules in your user [profile](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-6), you may need to [import the module manually](https://msdn.microsoft.com/en-us/library/dd878284(v=vs.85).aspx).\n\n```\nImport-Module C:\\Program Files\\WindowsPowerShell\\Modules\\Meerkat\\Meerkat.psm1\n```\n\nIt is recommended that the following approach be taken to assist in locating where the actual issue resides.\n\n#### TEST 1 – DOES MEERKAT WORK LOCALLY?\n- Test Meerkat against the local system\n  - Invoke-Meerkat\n\n#### TEST 2 – DOES REMOTE SCANNING WORK?\nNote: Perform this test with an account that has local admin rights on the target system.\n\n- Test Meerkat against a remote Windows system\n  - Invoke-Meerkat -Computer RemoteName\n\n#### TEST 3 – CAN YOU CREATE THE SCHEDULE TASK AND MSA?\n- Remove any existing Scheduled Tasks related to Meerkat\n- Remove any MSA’s related to Meerkat\n- Configure the Schedule-Meerkat.ps1 file, then run it.\n\n#### TEST 4 – DOES MEERKAT-TASK.PS1 WORK?\nNote: Perform this test with an account that has local admin rights on the target system.\n\n- Configure the Meerkat-Task.ps1 file with # OPTION 1 (local host)\n- Run the script manually.\n\n#### TEST 5 – DOES THE SCHEDULED TASK AND THE MSA WORK?\n- Run the Meerkat-Task.ps1 script via Scheduled Tasks.\n\nIf this fails:\n- Ensure WinRM is enabled on remote host\n- Ensure the MSA has local admin rights on remote host\n\n#### TEST 6 – DOES THE MEERKAT-TASK.PS1 WORK REMOTELY?\n- Configure the Meerkat-Daily-Task.ps1 file with # OPTION 3 (remote host, Daily)\n  - Specify a remote host in hosts.txt\n  - Run the script manually with an account with local admin on the remote system.\n\n#### TEST 7 – DOES THE MSA HAVE PROPER PERMISSIONS ON REMOTE HOSTS?\n- Configure the Meerkat-Task.ps1 file with # OPTION 3 (remote host, Daily)\n  - Specify a remote host in hosts.txt\n  - Run the Meerkat-Task.ps1 script via Scheduled Tasks.\n\n#### TEST 8 – DOES EVERYTHING NOW WORK?\n- Configure the Meerkat-Task.ps1 file with # OPTION 2 (fully automated domain scan)\n  - Run the script manually with an account with local admin on the remote system.\n  - Run the Meerkat-Task.ps1 script via Scheduled Tasks.\n\n\n\n\n## Adding a New Module\n- Create the new .psm1 file, preferrably from copying an existing module with similar enough logic and using it as a starting point.\n  - Update the module name\n  - Using find and replace, replace all instances of the template's name\n  - Update the Synopsis, Description, Parameters, Examples, and Notes sections\n  - Replace the process{} logic with the new logic. Ensure it returns an array of matching PowerShell objects.\n  - Save the module with an appropriate name.\n- Add the new module name to Meerkat.psd1. This can be done manually or by running /Utilities/Generate-ModuleManifest.ps1\n- Add the new module to the table in this README.md\n  - Add to the Artifacts table.\n- Add the new module to Invoke-Meerkat.psm1\n  - Add to the Paramater m/mod/modules, including both the ValidateSet and the $Modules array itself.\n  - In begin{}, add to $ModuleCommandArray\n  - In begin{}, add to ```if ($All) {}``` code block\n  - If the module takes more than a few seconds, also add to ```if ($Quick) {``` code block. This prevents it from running when the user invokes -Fast\n\n\n## Screenshots\n\nOutput of Command \"Invoke-Meerkat\"\n\n![Output of Command \"Invoke-Meerkat\"](https://i.imgur.com/C5eKInZ.png)\n\nOutput Files\n\n![Output Files](https://i.imgur.com/dy3f1Id.png)\n\n\n## Similar Projects\n\n- https://github.com/travisfoley/dfirtriage\n- https://github.com/Invoke-IR/PowerForensics\n- https://github.com/PowerShellMafia/CimSweep\n- https://www.crowdstrike.com/resources/community-tools/crowdresponse/\n- https://github.com/gfoss/PSRecon/\n- https://github.com/n3l5/irCRpull\n- https://github.com/davehull/Kansa/\n- https://github.com/WiredPulse/PoSh-R2\n- https://github.com/google/grr\n- https://github.com/diogo-fernan/ir-rescue\n- https://github.com/SekoiaLab/Fastir_Collector\n- https://github.com/AlmCo/Panorama\n- https://github.com/certsocietegenerale/FIR\n- https://github.com/securycore/Get-Baseline\n- https://github.com/Infocyte/PSHunt\n- https://github.com/giMini/NOAH\n- https://github.com/A-mIn3/WINspect\n- https://learn.duffandphelps.com/kape\n- https://www.brimorlabs.com/tools/\n\nWhat makes Meerkat stand out?\n- Lightweight. Fits on a floppy disk!\n- Very little footprint/impact on targets.\n- Leverages Powershell \u0026 WMI/CIM.\n- Coding style encourages proper code review, learning, and \"borrowing.\"\n- No DLLs or compiled components.\n- Standardized output - defaults to .csv, and can easily support json, xml, etc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTonyPhipps%2FMeerkat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FTonyPhipps%2FMeerkat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTonyPhipps%2FMeerkat/lists"}