davidpany / WMI_Forensics
☆302Updated 4 years ago
Alternatives and similar repositories for WMI_Forensics:
Users that are interested in WMI_Forensics are comparing it to the libraries listed below
- "Evolving AppCompat/AmCache data analysis beyond grep"☆201Updated 3 years ago
- ☆275Updated last year
- ATT&CK Remote Threat Hunting Incident Response☆200Updated 3 months ago
- Scripts to facilitate filtering with Plaso☆124Updated 4 years ago
- Lists of sources and utilities utilized to hunt, detect and prevent evildoers.☆165Updated 6 years ago
- Tool Analysis Result Sheet☆347Updated 7 years ago
- ☆116Updated last year
- Powershell Threat Hunting Module☆283Updated 8 years ago
- ☆349Updated 4 years ago
- EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.☆192Updated last week
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆115Updated 4 years ago
- Misc Threat Hunting Resources☆373Updated 2 years ago
- A repo containing tools developed by Carbon Black's Threat Research Team: Threat Analysis Unit☆232Updated 3 years ago
- ☆427Updated last year
- Invoke-LiveResponse☆147Updated 3 years ago
- Dump of organized knowledge on DFIR☆133Updated 3 years ago
- A VBA parser and emulation engine to analyze malicious macros.☆95Updated last month
- Collection of useful, up to date, Carbon Black Response Queries☆83Updated 4 years ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆424Updated 4 years ago
- Digital forensic acquisition tool for Windows based incident response.☆338Updated 10 months ago
- Collecting & Hunting for IOCs with gusto and style☆237Updated 3 years ago
- Parses amcache.hve files, but with a twist!☆130Updated 2 months ago
- A modern Python-3-based alternative to RegRipper☆193Updated 3 months ago
- Cuckoo running in a nested hypervisor☆128Updated 4 years ago
- Mark Baggett's (@MarkBaggett - GSE #15, SANS SEC573 Author) tool for detecting randomness using NLP techniques rather than pure entropy c…☆125Updated 2 years ago
- PowerShell No Agent Hunting☆110Updated 6 years ago
- Data from a BRAWL Automated Adversary Emulation Exercise☆204Updated 4 years ago
- Set of Yara rules for finding files using magics headers☆136Updated 4 years ago
- Automagically extract forensic timeline from volatile memory dump☆128Updated 10 months ago
- Parser for Windows PowerShell script block logs☆95Updated 7 months ago