A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaissance of Windows-based endpoints without requiring a pre-deployed agent. Use cases include incident response triage, threat hunting, baseline monitoring, snapshot comparisons, and more.
Host Info | Net Adapters | Processes* | Services | Files |
---|---|---|---|---|
Audit Policy | Windows Firewall Rules | DLLs* | Local Users | ADS |
Disks | Ports | Strings* | Local Groups | Recycle Bin |
Hotfixes | ARP | Handles* | Scheduled Tasks | Hosts File |
TPM | DNS | EnvVars | Autoruns | Certificates |
Software | Net Routes | Sessions | Bitlocker | Select Registry |
Hardware | Shares | Domain Information | Defender | Event Logs |
Drivers | USBHistory | Event Logs Metadata | Events Related to Login Failures | |
Events Related to User/Group Management | ||||
Event Logs Metadata |
In a Command or PowerShell console, type the following...
git clone "https://github.com/TonyPhipps/Meerkat" "C:\Program Files\WindowsPowerShell\Modules\Meerkat"
To update...
cd C:\Program Files\WindowsPowerShell\Modules\Meerkat
git pull
Copy/paste this into a PowerShell console
$Modules = "C:\Program Files\WindowsPowerShell\Modules\"
New-Item -ItemType Directory $Modules\Meerkat\ -force
Invoke-WebRequest https://github.com/TonyPhipps/Meerkat/archive/master.zip -OutFile $Modules\master.zip
Expand-Archive $Modules\master.zip -DestinationPath $Modules
Copy-Item $Modules\Meerkat-master\* $Modules\Meerkat\ -Force -Recurse
Remove-Item $Modules\Meerkat-master -Recurse -Force
To update, simply run the same block of commands again.
Functions can also be used by opening the .psm1 file and copy-pasting its entire contents into a PowerSell console.
This command will output results to C:\Users\YourName\Meerkat\
Invoke-Meerkat
NOTE: The following modules will not return results if not ran with Administrative privileges
Analysis methodologies and techniques are provided in the Wiki pages.
Installing a Powershell Module
If your system does not automatically load modules in your user profile, you may need to import the module manually.
Import-Module C:\Program Files\WindowsPowerShell\Modules\Meerkat\Meerkat.psm1
It is recommended that the following approach be taken to assist in locating where the actual issue resides.
Note: Perform this test with an account that has local admin rights on the target system.
Note: Perform this test with an account that has local admin rights on the target system.
If this fails:
if ($All) {}
code blockif ($Quick) {
code block. This prevents it from running when the user invokes -FastOutput of Command "Invoke-Meerkat"
Output Files
What makes Meerkat stand out?