91 repositories
| # ↓ | Repository | Stars | Forks | Description | Last push |
|---|---|---|---|---|---|
| 1↑1 | ChrisTitusTech/winutil | 63,262 | 3,702 | Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates | 2026-09-26 |
| 2↑5 | Raphire/Win11Debloat | 57,651 | 2,461 | A simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other changes to declutter a | 2026-09-10 |
| 3↑64 | zhaoxuya520/reverse-skill | 38,324 | 5,326 | Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolvin | 2026-09-22 |
| 4↓9 | cmderdev/cmder | 27,005 | 2,074 | Lovely console emulator package for Windows | 2026-09-21 |
| 5↓5 | ScoopInstaller/Scoop | 24,703 | 1,539 | A command-line installer for Windows. | 2026-09-26 |
| 6↑6 | SpotX-Official/SpotX | 22,490 | 1,129 | SpotX patcher used for patching the desktop version of Spotify | 2026-09-23 |
| 7↓7 | dotnet/core | 22,040 | 4,938 | .NET news, announcements, release notes, and more! | 2026-09-27 |
| 8↓3 | ntdevlabs/tiny11builder | 19,659 | 1,513 | Scripts to build a trimmed-down Windows 11 image. | 2025-09-12 |
| 9↓8 | Sycnex/Windows10Debloater | 18,819 | 2,053 | Script to remove Windows 10 bloatware. | 2023-03-10 |
| 10↓3 | YerongAI/Office-Tool | 14,308 | 1,053 | Office Tool Plus localization projects. | 2026-09-21 |
| 11↑68 | actions/runner-images | 13,387 | 3,872 | GitHub Actions runner images | 2026-09-27 |
| 12↑6 | zoicware/RemoveWindowsAI | 13,102 | 458 | Force Remove Copilot, Recall and More in Windows 11 | 2026-09-27 |
| 13↓10 | PowerShellMafia/PowerSploit | 13,079 | 4,710 | PowerSploit - A PowerShell Post-Exploitation Framework | 2020-08-17 |
| 14↓15 | microsoft/sql-server-samples | 11,236 | 9,089 | Azure Data SQL Samples - Official Microsoft GitHub Repository containing code samples for SQL Server, Azure SQL, Azure Synapse, and Azure SQL Edge | 2026-09-24 |
| 15↓24 | SpecterOps/BloodHound-Legacy | 10,611 | 1,792 | Six Degrees of Domain Admin | 2026-03-02 |
| 16↓18 | samratashok/nishang | 10,125 | 2,543 | Nishang - Offensive PowerShell for red team, penetration testing and offensive security. | 2024-04-25 |
| 17↓11 | farag2/Sophia-Script-for-Windows | 9,768 | 644 | :zap: The most powerful PowerShell module for fine-tuning Windows 10 & Windows 11 on GitHub | 2026-09-27 |
| 18↓26 | dotnet/blazor | 9,262 | 640 | Blazor moved to https://github.com/dotnet/aspnetcore | 2021-02-23 |
| 19↓14 | mandiant/flare-vm | 9,073 | 1,117 | A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM. | 2026-06-23 |
| 20↓2 | Orange-Cyberdefense/GOAD | 8,384 | 1,141 | game of active directory | 2026-03-12 |
| 21↓22 | dahlbyk/posh-git | 8,274 | 823 | A PowerShell environment for Git | 2024-09-02 |
| 22↓23 | EmpireProject/Empire | 7,857 | 2,933 | Empire is a PowerShell and Python post-exploitation agent. | 2020-01-19 |
| 23↓18 | mandiant/commando-vm | 7,810 | 1,371 | Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com | 2025-10-16 |
| 24↓20 | jenkinsci/docker | 7,646 | 4,573 | Docker official jenkins repo | 2026-09-25 |
| 25↓15 | I-Am-Jakoby/Flipper-Zero-BadUSB | 7,103 | 892 | Repository for my flipper zero badUSB payloads. Now almost entirely plug and play. | 2024-06-15 |
| 26↓43 | LeDragoX/Win-Debloat-Tools | 6,369 | 317 | Re-imagining Windows like a minimal OS install, already debloated with minimal impact for most functionality. | 2025-10-03 |
| 27↓34 | k8gege/K8tools | 6,224 | 2,056 | K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra | 2025-01-25 |
| 28↓40 | W4RH4WK/Debloat-Windows-10 | 6,142 | 789 | A Collection of Scripts Which Disable / Remove Windows 10 Features and Apps | 2025-09-23 |
| 29↑14 | hak5/usbrubberducky-payloads | 6,044 | 1,680 | The Official USB Rubber Ducky Payload Repository | 2026-09-01 |
| 30↓35 | jamesstringer90/Easy-GPU-PV | 5,591 | 564 | A Project dedicated to making GPU Partitioning on Windows easier! | 2026-06-01 |
| 31↓32 | janikvonrotz/awesome-powershell | 5,407 | 448 | This repository has been moved to https://codeberg.org/janikvonrotz/awesome-powershell. Please visit the new location for the latest updates. | 2025-04-14 |
| 32↓38 | JanDeDobbeleer/oh-my-posh2 | 5,213 | 275 | A prompt theming engine for Powershell | 2021-02-16 |
| 33↓50 | denverdino/k8s-for-docker-desktop | 5,038 | 1,112 | 为Docker Desktop for Mac/Windows开启Kubernetes和Istio。 | 2026-05-19 |
| 34↓20 | mantvydasb/RedTeaming-Tactics-and-Techniques | 4,708 | 1,140 | Red Teaming Tactics and Techniques | 2026-06-13 |
| 35↓54 | dotnet/machinelearning-samples | 4,684 | 2,664 | Samples for ML.NET, an open source and cross-platform machine learning framework for .NET. | 2026-09-03 |
| 36↓53 | Disassembler0/Win10-Initial-Setup-Script | 4,639 | 1,018 | PowerShell script for automation of routine tasks done after fresh installations of Windows 10 / Server 2016 / Server 2019 | 2021-05-28 |
| 37↓21 | love2d-community/awesome-love2d | 4,507 | 247 | A curated list of amazingly awesome LÖVE libraries, resources and shiny things. | 2026-09-26 |
| 38↓28 | danielbohannon/Invoke-Obfuscation | 4,333 | 820 | PowerShell Obfuscator | 2023-08-10 |
| 39↑2 | itm4n/PrivescCheck | 3,970 | 508 | Privilege Escalation Enumeration Script for Windows | 2026-09-27 |
| 40↓43 | omerbsezer/Fast-Kubernetes | 3,855 | 1,436 | This repo covers Kubernetes with LABs: Kubectl, Pod, Deployment, Service, PV, PVC, Rollout, Multicontainer, Daemonset, Taint-Toleration, Job, Ingress, Kubeadm, | 2025-04-14 |
| 41↓58 | 0xsyr0/OSCP | 3,852 | 770 | OSCP Cheat Sheet | 2026-09-12 |
| 42↓36 | tibold/svg-explorer-extension | 3,715 | 202 | Extension module for Windows Explorer to render SVG thumbnails, so that you can have an overview of your SVG files | 2020-06-01 |
| 43↓58 | S3cur3Th1sSh1t/WinPwn | 3,695 | 536 | Automation for internal Windows Penetrationtest / AD-Security | 2025-08-28 |
| 44↑180 | psmux/psmux | 3,561 | 214 | Tmux on Windows Powershell - tmux for PowerShell, Windows Terminal, cmd.exe. Includes psmux, pmux, and tmux commands. This is native High-Performance Tmux desig | 2026-09-27 |
| 45↓57 | ChrisTitusTech/win10script | 3,486 | 997 | This is the Ultimate Windows 10 Script from a creation from multiple debloat scripts and gists from github. | 2022-06-24 |
| 46↓42 | pester/Pester | 3,346 | 477 | Pester is the ubiquitous test and mock framework for PowerShell. | 2026-09-24 |
| 47↓78 | dafthack/MailSniper | 3,279 | 595 | MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network a | 2026-09-21 |
| 48↓28 | fleschutz/PowerShell | 3,256 | 548 | 600+ free PowerShell scripts (.ps1) for Linux, macOS, and Windows. | 2026-09-08 |
| 49↓39 | mgeeky/Penetration-Testing-Tools | 3,018 | 545 | A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes | 2023-06-27 |
| 50↓40 | hak5/bashbunny-payloads | 2,967 | 1,477 | The Official Bash Bunny Payload Repository | 2026-06-13 |
| 51↓54 | hotvulcan/Thanos.sh | 2,963 | 282 | if you are Thanos(root), this command could delete half your files randomly | 2026-02-12 |
| 52↓11 | devblackops/Terminal-Icons | 2,949 | 139 | A PowerShell module to show file and folder icons in the terminal | 2024-08-06 |
| 53↓21 | pbatard/Fido | 2,895 | 256 | A PowerShell script to download Windows or UEFI Shell ISOs | 2026-03-30 |
| 54↓68 | lazywinadmin/PowerShell | 2,881 | 743 | PowerShell functions and scripts (Azure, Active Directory, SCCM, SCSM, Exchange, O365, ...) | 2026-09-03 |
| 55↓14 | dataplat/dbatools | 2,845 | 867 | 🚀 SQL Server automation and instance migrations have never been safer, faster or freer | 2026-09-27 |
| 56↓73 | chocolatey-archive/chocolatey | 2,792 | 331 | [DEPRECATED - https://github.com/chocolatey/choco] Chocolatey NuGet - Like apt-get, but for windows. | 2017-03-03 |
| 57↓48 | Integration-IT/Active-Directory-Exploitation-Cheat-Sheet | 2,768 | 519 | A cheat sheet that contains common enumeration and attack methods for Windows Active Directory. | 2025-07-06 |
| 58↓20 | dfinke/ImportExcel | 2,745 | 414 | PowerShell module to import/export Excel spreadsheets, without Excel | 2026-08-22 |
| 59↓58 | NetSPI/PowerUpSQL | 2,741 | 471 | PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server | 2024-12-12 |
| 60↓72 | FuzzySecurity/PowerShell-Suite | 2,735 | 759 | My musings with PowerShell | 2021-11-19 |
| 61↑54 | cisagov/ScubaGear | 2,684 | 381 | Automation to assess the state of your M365 tenant against CISA's baselines | 2026-09-26 |
| 62↓31 | 0x6d69636b/windows_hardening | 2,662 | 332 | HardeningKitty and Windows Hardening Settings | 2026-08-31 |
| 63↓68 | Cloud-Architekt/AzureAD-Attack-Defense | 2,557 | 368 | This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigat | 2026-06-30 |
| 64↑25 | MicrosoftDocs/PowerShell-Docs | 2,555 | 1,722 | The official PowerShell documentation sources | 2026-09-24 |
| 65↓52 | monoxgas/sRDI | 2,552 | 489 | Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode | 2023-11-15 |
| 66↓45 | NetSPI/MicroBurst | 2,444 | 339 | A collection of scripts for assessing Microsoft Azure security | 2026-06-29 |
| 67↑2993 | microsoft/WindowsDeveloperConfig | 2,440 | 175 | Automate the setup and configuration of your Windows development environment. | 2026-09-26 |
| 68↓88 | sans-blue-team/DeepBlueCLI | 2,431 | 379 | — | 2023-10-14 |
| 69↓31 | Microsoft365DSC/Microsoft365DSC | 2,397 | 679 | Manages, configures, extracts and monitors Microsoft 365 tenant configurations | 2026-09-27 |
| 70↓93 | besimorhino/powercat | 2,395 | 482 | netshell features all in version 2 powershell | 2024-03-05 |
| 71↓55 | safebuffer/vulnerable-AD | 2,334 | 446 | Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab | 2024-04-12 |
| 72↓40 | davidprowe/BadBlood | 2,270 | 289 | BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain s | 2023-06-07 |
| 73↓76 | DarkCoderSc/PowerRemoteDesktop | 2,243 | 262 | Remote Desktop entirely coded in PowerShell. | 2024-08-01 |
| 74↓55 | AutomatedLab/AutomatedLab | 2,228 | 383 | AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Wind | 2026-07-06 |
| 75↓95 | PowerShellEmpire/PowerTools | 2,209 | 815 | PowerTools is a collection of PowerShell projects with a focus on offensive operations. | 2021-12-28 |
| 76↓123 | peewpw/Invoke-PSImage | 2,187 | 383 | Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute | 2019-09-23 |
| 77↓63 | pnp/List-Formatting | 2,180 | 928 | List Formatting Samples for use in SharePoint and Microsoft Lists | 2026-09-15 |
| 78↓27 | ScoopInstaller/Extras | 2,160 | 1,801 | 📦 The Extras bucket for Scoop. | 2026-09-27 |
| 79↓91 | last-byte/PersistenceSniper | 2,142 | 222 | Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twi | 2024-12-11 |
| 80↓54 | nettitude/PoshC2 | 2,137 | 354 | A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement. | 2025-11-20 |
| 81↑20 | dafthack/DomainPasswordSpray | 2,094 | 413 | DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the | 2024-07-11 |
| 82↓97 | api0cradle/UltimateAppLockerByPassList | 2,082 | 361 | The goal of this repository is to document the most common techniques to bypass AppLocker. | 2023-09-11 |
| 83↑108 | Micke-K/IntuneManagement | 2,078 | 379 | Copy, export, import, delete, document and compare policies and profiles in Intune and Azure with PowerShell script and WPF UI. Import ADMX files and registry s | 2026-09-23 |
| 84↓98 | ThioJoe/Windows-Super-God-Mode | 2,076 | 143 | Creates shortcuts to virtually every special location or action built into Windows | 2026-06-04 |
| 85↑73 | meetrevision/playbook | 2,073 | 121 | A lightweight, stable, and performance-focused customized version of Windows that enhances privacy and compatibility | 2026-09-21 |
| 86new | 0Chencc/clawgod | 2,069 | 329 | ClawGod is a runtime patch applied to the official Claude Code. It continues to be supported with each version update. | 2026-09-27 |
| 87↓5 | admindroid-community/powershell-scripts | 2,026 | 487 | Office 365 Reporting PowerShell Scripts | 2026-09-16 |
| 88↓77 | MicrosoftDocs/architecture-center | 2,022 | 1,841 | Open source documentation for the Azure Architecture Center on Microsoft Learn. | 2026-09-26 |
| 89↓137 | GuDaStudio/skills | 2,020 | 99 | This repository contains a collection of Agent Skills developed by GudaStudio, enabling seamless collaboration between Claude and other AI models and tools. | 2025-12-23 |
| 90↓148 | rasta-mouse/Sherlock | 2,018 | 411 | PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. | 2018-10-10 |
| 91new | Romanitho/Winget-AutoUpdate | 2,002 | 194 | WAU daily updates apps as system and notify connected users. (Allowlist and Blocklist support) | 2026-09-14 |