forensiclunch / ETLParser
Binary commandline executable to parse ETL files
☆67Updated 6 years ago
Related projects: ⓘ
- Parses the WMI object database....looking for persistence☆31Updated 4 years ago
- Trace ScriptBlock execution for powershell v2☆39Updated 4 years ago
- Windows registry samples☆23Updated 5 years ago
- Extract compressed memory pages from page-aligned data☆41Updated 5 years ago
- Extract BITS jobs from QMGR queue and store them as CSV records☆73Updated 2 months ago
- Steezy - Ghetto Yara Generation☆15Updated last year
- Generate a Yara rule to find base64-encoded files containg a specific keyword☆39Updated 6 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 6 years ago
- PowerShell Script to facilitate the processing of SRUM data for on-the-fly forensics and if needed threat hunting☆16Updated 4 years ago
- hopefully a source-to-source deobfuscator, aiming at deobfuscating common scripts languages such as Powershell, VBA and Javascript. Curre…☆40Updated 5 years ago
- Generate YARA rules for OOXML documents.☆37Updated last year
- Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.☆21Updated 5 years ago
- Handy scripts to speed up malware analysis☆35Updated 11 months ago
- Carve NTFS USN records from binary data☆24Updated 7 years ago
- Extract common Windows artifacts from source images and VSCs☆65Updated 3 years ago
- Basic demo for Hidden Treasure talk.☆49Updated 6 years ago
- An Inofficial Sysmon Version History (Change Log)☆32Updated 3 years ago
- TA505 unpacker Python 2.7☆45Updated 4 years ago
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆36Updated 7 years ago
- Random hunting ordiented yara rules☆95Updated last year
- ☆22Updated this week
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- Detect possible sysmon logging bypasses given a specific configuration☆107Updated 5 years ago
- A repository that maps API calls to Sysmon Event ID's.☆116Updated last year
- Tool to parse SRU database☆24Updated 6 years ago
- ☆85Updated this week
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆36Updated last year
- Tool to decompress data from Windows 10 page files and memory dumps, that has been compressed by the Windows 10 memory manager.☆47Updated 5 years ago
- Tools for parsing Forensic images☆41Updated 5 years ago
- Information about most important hunts which can be performed by Threat hunters while searching for any adversary/threats inside the orga…☆15Updated 5 years ago