evtx2json extracts events of interest from event logs, dedups them, and exports them to json.
☆41May 3, 2021Updated 4 years ago
Alternatives and similar repositories for evtx2json
Users that are interested in evtx2json are comparing it to the libraries listed below
Sorting:
- 🦉🔬A small PowerShell tool for finding information quickly on malicious IPs or FQDNs. Powershell threat hunting.☆11Jan 9, 2020Updated 6 years ago
- Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.☆21Mar 12, 2019Updated 6 years ago
- Extract common Windows artifacts from source images and VSCs☆64May 10, 2021Updated 4 years ago
- macOS Artifact Intelligence Tool☆13Apr 30, 2019Updated 6 years ago
- Python tool and library to help analyze files during malware triage and analysis.☆78Jul 2, 2020Updated 5 years ago
- A tool to convert Windows evtx files (Windows Event Log Files) into JSON format and log to Splunk (optional) using HTTP Event Collector.☆58Apr 8, 2022Updated 3 years ago
- WLEAPP is an open source project that aims to parse Windows OS artifacts for the purpose of triage analysis.☆32Nov 16, 2023Updated 2 years ago
- Windows Thingies... but in Rust☆23Nov 12, 2022Updated 3 years ago
- Library of threat hunts to get any user started!☆50Sep 4, 2020Updated 5 years ago
- These are some of the commands which I use frequently during Malware Analysis and DFIR.☆24Jan 8, 2024Updated 2 years ago
- macOS triage is a python script to collect various macOS logs, artifacts, and other data.☆25Mar 25, 2021Updated 4 years ago
- Emulates the Sysinternals Autoruns tool, but for DFIR purposes e.g. multi user processing☆55May 18, 2019Updated 6 years ago
- CTI-URLScan is a command line tool to enable analysts to search URLscan.io submissions. Pull screenshot and DOM content. As well as, auto…☆10Mar 2, 2021Updated 5 years ago
- Generic Signature Format for SIEM Systems☆14Oct 27, 2021Updated 4 years ago
- A script to assist in processing forensic RAM captures for malware triage☆26Feb 4, 2021Updated 5 years ago
- Simple Script to Help You Find All Files Has Been Modified, Accessed, and Created In A Range Time.☆27Dec 1, 2022Updated 3 years ago
- ETW-Almulahaza is a consumer python-based tool that help you monitor ETW events of the operating system☆13Jun 24, 2022Updated 3 years ago
- A not-at-all-ordered compilation of random security-related powershell scripts :-)☆12Feb 24, 2022Updated 4 years ago
- Technical add-on to ingest json formatted volatility memory analysis plugin outputs☆13May 21, 2018Updated 7 years ago
- ☆12Jun 29, 2021Updated 4 years ago
- Athenz is a role-based authorization (RBAC) system for provisioning and configuration (centralized authorization) use cases as well as se…☆13Oct 29, 2019Updated 6 years ago
- A triage data collection script for macOS☆29Nov 27, 2020Updated 5 years ago
- Attempt to replicate the functions of auto_rip by Corey Harrell in Python.☆12Aug 4, 2024Updated last year
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆19Feb 26, 2024Updated 2 years ago
- A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.☆14Oct 21, 2021Updated 4 years ago
- This repo exists as a quick and dirty arsenal of methods and scripts to subvert .NET SSL/TLS certificate validation in PowerShell and pre…☆12Jan 28, 2017Updated 9 years ago
- Multicore EVTX to Elasticsearch ingestor for incident responders.☆14May 12, 2021Updated 4 years ago
- A tool to run a command when the target of a symlink changes☆16Apr 28, 2016Updated 9 years ago
- Various Topics☆18Apr 30, 2025Updated 10 months ago
- A Windows Event Processing Utility☆47Feb 21, 2018Updated 8 years ago
- The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted driv…☆343Jun 25, 2022Updated 3 years ago
- ☆28Mar 29, 2022Updated 3 years ago
- ☆33Feb 26, 2022Updated 4 years ago
- Threat Simulator for Enterprise Networks☆14May 14, 2022Updated 3 years ago
- ☆15Jun 4, 2018Updated 7 years ago
- Tool to rip system and user data from OSX and macOS☆16Dec 6, 2022Updated 3 years ago
- Threat Feeds, Threat lists, and regular lists of known IP ranges and domains. It updates every 4 hours.☆16May 21, 2021Updated 4 years ago
- An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.☆22Feb 21, 2026Updated last week
- A Heroku-based web honeypot that can be used to create and monitor fake HTTP endpoints (i.e. honeytokens).☆65Apr 24, 2019Updated 6 years ago