fox-it / danderspritz-evtxLinks
Parse evtx files and detect use of the DanderSpritz eventlogedit module
☆148Updated 7 years ago
Alternatives and similar repositories for danderspritz-evtx
Users that are interested in danderspritz-evtx are comparing it to the libraries listed below
Sorting:
- Log newly created WMI consumers and processes to the Windows Application event log☆124Updated 7 years ago
- Allows you to quickly query a Windows machine for RAM artifacts☆220Updated 5 years ago
- Reconstruct process trees from event logs☆147Updated 5 years ago
- ☆278Updated 2 years ago
- Python script to decode common encoded PowerShell scripts☆216Updated 7 years ago
- ☆350Updated 4 years ago
- PowerShell No Agent Hunting☆109Updated 7 years ago
- Page File analysis tools.☆128Updated 9 years ago
- ☆427Updated 2 years ago
- Malware Sinkhole List in various formats☆102Updated 3 years ago
- Lazy Office Analyzer☆122Updated 8 years ago
- Detecting Lateral Movement with Machine Learning☆138Updated 7 years ago
- VolatilityBot – An automated memory analyzer for malware samples and memory dumps☆270Updated 4 years ago
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆119Updated last year
- Python script for extracting USB information from Windows registry hives☆128Updated 6 years ago
- This repository contains the website and the tools which are part of the joint research between Check Point Research and Intezer to map t…☆110Updated 5 years ago
- Toolset for research malware and Cobalt Strike beacons☆211Updated 5 months ago
- A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.☆172Updated 6 months ago
- PowerShell script for hunting webshells on Microsoft Exchange Servers.☆56Updated 8 years ago
- snake - a malware storage zoo☆216Updated 2 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆108Updated 4 years ago
- IR-Tools - PowerShell tools for IR☆130Updated 8 years ago
- Autoruns plugin for the Volatility framework☆122Updated 6 years ago
- Query and report user logons relations from MS Windows Security Events☆243Updated 7 years ago
- Various config files obtained during malware analysis☆67Updated 6 years ago
- PE Import Hash Generator☆81Updated 8 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆118Updated 4 years ago
- ☆134Updated 6 years ago
- Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launche…☆264Updated 3 years ago
- Django web interface for managing Yara rules☆193Updated 7 years ago