A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
☆187Aug 18, 2026Updated 2 months ago
Alternatives and similar repositories for Blauhaunt
Users that are interested in Blauhaunt are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆11Jun 12, 2023Updated 3 years ago
- ShellSweeping the evil.☆185Jul 22, 2026Updated 2 months ago
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆677Oct 11, 2026Updated last week
- ☆212May 10, 2026Updated 5 months ago
- A centralized and enhanced memory analysis platform☆540Sep 29, 2026Updated 2 weeks ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory C…☆274Nov 24, 2023Updated 2 years ago
- DFIQ is a collection of investigative questions and the approaches for answering them☆316Mar 10, 2026Updated 7 months ago
- orc2timeline extracts and analyzes artifacts contained in archives generated with DFIR-ORC.exe to create a timeline from them☆34Jun 27, 2025Updated last year
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆90Feb 9, 2025Updated last year
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆93Aug 30, 2024Updated 2 years ago
- MDE relies on some of the Audit settings to be enabled☆101Jul 15, 2022Updated 4 years ago
- A repository to share publicly available Velociraptor detection content☆208Oct 11, 2026Updated last week
- Documentation and scripts to properly enable Windows event logs.☆723Oct 3, 2025Updated last year
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆93Sep 14, 2026Updated last month
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is de…☆829Apr 18, 2026Updated 6 months ago
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,404Updated this week
- ☆569Mar 28, 2024Updated 2 years ago
- ☆84Feb 4, 2026Updated 8 months ago
- The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifa…☆666Jul 14, 2026Updated 3 months ago
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆872Jan 20, 2022Updated 4 years ago
- Live Feed of C2 servers, tools, and botnets☆785Apr 13, 2026Updated 6 months ago
- UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It …☆1,488Sep 9, 2026Updated last month
- ☆59Dec 13, 2025Updated 10 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows re…☆93Jul 29, 2025Updated last year
- Awesome list of keywords and artifacts for Threat Hunting sessions☆676Aug 4, 2025Updated last year
- The MAGIC tool is a wrapper around the Microsoft Graph Python SDK, designed to download incident response-relevant data from M365 environ…☆34Apr 13, 2026Updated 6 months ago
- ☆133Feb 19, 2026Updated 7 months ago
- Modular web-application honeypot platform built using go and gin☆64May 8, 2024Updated 2 years ago
- Provides an advanced baseline to implement a secure Windows auditing strategy on Windows OS.☆70Feb 22, 2026Updated 7 months ago
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆266Oct 29, 2025Updated 11 months ago
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆863Updated this week
- An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents, references and secur…☆176Oct 4, 2026Updated 2 weeks ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆33Feb 26, 2022Updated 4 years ago
- ☆84Nov 21, 2024Updated last year
- WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）☆776Feb 3, 2023Updated 3 years ago
- ☆92Jul 30, 2025Updated last year
- Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts…☆1,171Oct 9, 2026Updated last week
- ☆271Jun 7, 2025Updated last year
- A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data int…☆2,572Updated this week