Silv3rHorn / evtx2jsonView external linksLinks
evtx2json extracts events of interest from event logs, dedups them, and exports them to json.
☆41May 3, 2021Updated 4 years ago
Alternatives and similar repositories for evtx2json
Users that are interested in evtx2json are comparing it to the libraries listed below
Sorting:
- 🦉🔬A small PowerShell tool for finding information quickly on malicious IPs or FQDNs. Powershell threat hunting.☆11Jan 9, 2020Updated 6 years ago
- Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.☆21Mar 12, 2019Updated 6 years ago
- Extract common Windows artifacts from source images and VSCs☆64May 10, 2021Updated 4 years ago
- macOS Artifact Intelligence Tool☆13Apr 30, 2019Updated 6 years ago
- Python tool and library to help analyze files during malware triage and analysis.☆78Jul 2, 2020Updated 5 years ago
- A tool to convert Windows evtx files (Windows Event Log Files) into JSON format and log to Splunk (optional) using HTTP Event Collector.☆58Apr 8, 2022Updated 3 years ago
- WLEAPP is an open source project that aims to parse Windows OS artifacts for the purpose of triage analysis.☆33Nov 16, 2023Updated 2 years ago
- Library of threat hunts to get any user started!☆48Sep 4, 2020Updated 5 years ago
- These are some of the commands which I use frequently during Malware Analysis and DFIR.☆24Jan 8, 2024Updated 2 years ago
- Emulates the Sysinternals Autoruns tool, but for DFIR purposes e.g. multi user processing☆55May 18, 2019Updated 6 years ago
- Generic Signature Format for SIEM Systems☆14Oct 27, 2021Updated 4 years ago
- GUI for regripper☆11Mar 19, 2019Updated 6 years ago
- Simple Script to Help You Find All Files Has Been Modified, Accessed, and Created In A Range Time.☆27Dec 1, 2022Updated 3 years ago
- A script to assist in processing forensic RAM captures for malware triage☆26Feb 4, 2021Updated 5 years ago
- Technical add-on to ingest json formatted volatility memory analysis plugin outputs☆13May 21, 2018Updated 7 years ago
- Athenz is a role-based authorization (RBAC) system for provisioning and configuration (centralized authorization) use cases as well as se…☆13Oct 29, 2019Updated 6 years ago
- ☆12Jun 29, 2021Updated 4 years ago
- A framework that correlates Bro events☆18Oct 25, 2013Updated 12 years ago
- A not-at-all-ordered compilation of random security-related powershell scripts :-)☆12Feb 24, 2022Updated 3 years ago
- A triage data collection script for macOS☆28Nov 27, 2020Updated 5 years ago
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆19Feb 26, 2024Updated last year
- Various Topics☆18Apr 30, 2025Updated 9 months ago
- This repo exists as a quick and dirty arsenal of methods and scripts to subvert .NET SSL/TLS certificate validation in PowerShell and pre…☆12Jan 28, 2017Updated 9 years ago
- A tool to run a command when the target of a symlink changes☆16Apr 28, 2016Updated 9 years ago
- A Windows Event Processing Utility☆47Feb 21, 2018Updated 7 years ago
- The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted driv…☆345Jun 25, 2022Updated 3 years ago
- ☆33Feb 26, 2022Updated 3 years ago
- Threat Simulator for Enterprise Networks☆14May 14, 2022Updated 3 years ago
- Threat Feeds, Threat lists, and regular lists of known IP ranges and domains. It updates every 4 hours.☆16May 21, 2021Updated 4 years ago
- ☆15Jun 4, 2018Updated 7 years ago
- An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.☆22Feb 21, 2024Updated last year
- A Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).☆65Apr 24, 2019Updated 6 years ago
- Windows 10 Live Information viewer☆37Jan 27, 2022Updated 4 years ago
- Open source training materials for law-enforcement and organisations interested in DFIR.☆63May 30, 2025Updated 8 months ago
- A forensic open-source parser module for Autopsy that allows extracting the messages, comments, posts, contacts, calendar entries and rea…☆115Jan 19, 2026Updated 3 weeks ago
- Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)☆196Feb 16, 2023Updated 2 years ago
- Checks observables/ioc in TheHive/Cortex against the MISP warningslists☆14Dec 27, 2017Updated 8 years ago
- Bolster NEO API - Artificial intelligence based zero-hour phishing detection☆13Aug 10, 2021Updated 4 years ago
- Repository with Sample threat hunting notebooks on Security Event Log Data Sources☆69Dec 2, 2022Updated 3 years ago