fox-it / danderspritz-evtxLinks
Parse evtx files and detect use of the DanderSpritz eventlogedit module
☆148Updated 7 years ago
Alternatives and similar repositories for danderspritz-evtx
Users that are interested in danderspritz-evtx are comparing it to the libraries listed below
Sorting:
- Allows you to quickly query a Windows machine for RAM artifacts☆220Updated 5 years ago
- Log newly created WMI consumers and processes to the Windows Application event log☆124Updated 7 years ago
- Python script to decode common encoded PowerShell scripts☆216Updated 7 years ago
- Reconstruct process trees from event logs☆146Updated 4 years ago
- ☆278Updated 2 years ago
- ☆351Updated 4 years ago
- PowerShell script for hunting webshells on Microsoft Exchange Servers.☆56Updated 8 years ago
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆119Updated last year
- Page File analysis tools.☆128Updated 9 years ago
- VolatilityBot – An automated memory analyzer for malware samples and memory dumps☆268Updated 4 years ago
- All materials from our Black Hat 2018 "Subverting Sysmon" talk☆135Updated 6 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆118Updated 4 years ago
- Lazy Office Analyzer☆122Updated 8 years ago
- PowerShell No Agent Hunting☆110Updated 7 years ago
- snake - a malware storage zoo☆216Updated 2 years ago
- Detecting Lateral Movement with Machine Learning☆138Updated 7 years ago
- This repository contains the website and the tools which are part of the joint research between Check Point Research and Intezer to map t…☆110Updated 5 years ago
- ☆304Updated 4 years ago
- Toolset for research malware and Cobalt Strike beacons☆211Updated 4 months ago
- Extract common Windows artifacts from source images and VSCs☆65Updated 4 years ago
- PE Import Hash Generator☆80Updated 8 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆108Updated 4 years ago
- Malware Sinkhole List in various formats☆102Updated 3 years ago
- Tools for DFIR☆120Updated 7 years ago
- Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launche…☆263Updated 3 years ago
- ☆134Updated 6 years ago
- Static based decoders for malware samples☆93Updated 5 years ago
- Python abstract API for PassiveTotal services in the form of libraries and command line utilities.☆85Updated 2 years ago
- Autoruns plugin for the Volatility framework☆122Updated 6 years ago
- Replay RDP traffic from PCAP☆199Updated 6 years ago