davidpany / WMI_Forensics
☆293Updated 4 years ago
Related projects: ⓘ
- ☆271Updated last year
- "Evolving AppCompat/AmCache data analysis beyond grep"☆192Updated 3 years ago
- Powershell Threat Hunting Module☆274Updated 7 years ago
- ATT&CK Remote Threat Hunting Incident Response☆196Updated 5 years ago
- EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.☆180Updated 4 years ago
- Tool Analysis Result Sheet☆342Updated 6 years ago
- ☆415Updated last year
- ☆344Updated 3 years ago
- Scripts to facilitate filtering with Plaso☆124Updated 4 years ago
- Digital forensic acquisition tool for Windows based incident response.☆328Updated 4 months ago
- Lists of sources and utilities utilized to hunt, detect and prevent evildoers.☆158Updated 5 years ago
- A repo containing tools developed by Carbon Black's Threat Research Team: Threat Analysis Unit☆228Updated 3 years ago
- Invoke-LiveResponse☆145Updated 2 years ago
- Misc Threat Hunting Resources☆368Updated last year
- Dump of organized knowledge on DFIR☆132Updated 2 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆114Updated 3 years ago
- ☆158Updated 3 years ago
- Parses amcache.hve files, but with a twist!☆115Updated 2 weeks ago
- c2 traffic☆187Updated last year
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆111Updated 3 months ago
- ☆167Updated 2 months ago
- A PowerShell module to deploy active directory decoy objects.☆220Updated 4 years ago
- Sysmon Tools for PowerShell☆230Updated 6 years ago
- ☆113Updated 7 months ago
- A VBA parser and emulation engine to analyze malicious macros.☆90Updated 3 weeks ago
- Collecting & Hunting for IOCs with gusto and style☆235Updated 3 years ago
- Log newly created WMI consumers and processes to the Windows Application event log☆123Updated 6 years ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆416Updated 3 years ago
- Allows you to quickly query a Windows machine for RAM artifacts☆218Updated 4 years ago
- A modern Python-3-based alternative to RegRipper☆184Updated 11 months ago