fireeye / BitsParserLinks
☆148Updated 11 months ago
Alternatives and similar repositories for BitsParser
Users that are interested in BitsParser are comparing it to the libraries listed below
Sorting:
- Command line access to the Registry☆147Updated 3 weeks ago
- Blueteam operational triage registry hunting/forensic tool.☆147Updated 2 years ago
- A repository that maps API calls to Sysmon Event ID's.☆121Updated 2 years ago
- Powershell Event Tracing Toolbox☆75Updated 3 years ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆65Updated 2 years ago
- A PowerShell incident response script for quick triage☆80Updated 2 years ago
- ☆87Updated last year
- Automagically extract forensic timeline from volatile memory dump☆130Updated last year
- Pushes Sysmon Configs☆88Updated 3 years ago
- A python script developed to process Windows memory images based on triage type.☆262Updated last year
- Sysmon EDR POC Build within Powershell to prove ability.☆224Updated 4 years ago
- YARA rule analyzer to improve rule quality and performance☆101Updated last month
- A series of PowerShell scripts to automate collection of forensic artefacts in most Incident Response environments☆65Updated 3 years ago
- ☆69Updated 3 months ago
- Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity☆91Updated 3 years ago
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆73Updated last year
- Digital Forensics Artifacts Knowledge Base☆81Updated last year
- An NTFS/FAT parser for digital forensics & incident response☆203Updated 6 months ago
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆166Updated 2 years ago
- ☆201Updated 7 months ago
- Parses amcache.hve files, but with a twist!☆135Updated 4 months ago
- $MFT directory tree reconstruction & FILE record info☆305Updated 7 months ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆113Updated 3 years ago
- Active Directory Purple Team Playbook☆108Updated 2 years ago
- HXTool is an extended user interface for the FireEye HX Endpoint product. HXTool can be installed on a dedicated server or on your physic…☆81Updated 11 months ago
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆117Updated 4 months ago
- evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.☆154Updated 3 years ago
- Manipulate timestamps on NTFS☆51Updated 10 years ago
- Collection of scripts used to deobfuscate GOOTLOADER malware samples.☆62Updated 5 months ago
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆78Updated 2 weeks ago