fireeye / BitsParserLinks
☆148Updated last year
Alternatives and similar repositories for BitsParser
Users that are interested in BitsParser are comparing it to the libraries listed below
Sorting:
- Command line access to the Registry☆148Updated last month
- Parses amcache.hve files, but with a twist!☆136Updated 5 months ago
- Blueteam operational triage registry hunting/forensic tool.☆148Updated 2 years ago
- A python script developed to process Windows memory images based on triage type.☆262Updated last year
- Digital Forensics Artifacts Knowledge Base☆82Updated last year
- Powershell Event Tracing Toolbox☆75Updated 3 years ago
- YARA rule analyzer to improve rule quality and performance☆102Updated 2 months ago
- A Cobalt Strike Scanner that retrieves detected Team Server beacons into a JSON object☆167Updated 2 years ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆113Updated 3 years ago
- A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …☆163Updated 7 months ago
- evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.☆154Updated 3 years ago
- ☆87Updated last year
- ☆201Updated 7 months ago
- Pushes Sysmon Configs☆88Updated 4 years ago
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆54Updated last year
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆73Updated last year
- ☆42Updated 5 months ago
- HXTool is an extended user interface for the FireEye HX Endpoint product. HXTool can be installed on a dedicated server or on your physic…☆82Updated 11 months ago
- ☆68Updated 4 months ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆65Updated 2 years ago
- My conference presentations☆66Updated last year
- Detection Ideas & Rules repository.☆179Updated 3 years ago
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆118Updated 5 months ago
- Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.☆114Updated last year
- Automagically extract forensic timeline from volatile memory dump☆131Updated last year
- Sysmon EDR POC Build within Powershell to prove ability.☆225Updated 4 years ago
- Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity☆93Updated 3 years ago
- A library for fast parse & import of Windows Eventlogs into Elasticsearch.☆85Updated last week
- ☆91Updated 3 years ago
- A PowerShell incident response script for quick triage☆80Updated 2 years ago