fox-it / danderspritz-evtx
Parse evtx files and detect use of the DanderSpritz eventlogedit module
☆148Updated 7 years ago
Alternatives and similar repositories for danderspritz-evtx:
Users that are interested in danderspritz-evtx are comparing it to the libraries listed below
- Allows you to quickly query a Windows machine for RAM artifacts☆220Updated 4 years ago
- Log newly created WMI consumers and processes to the Windows Application event log☆124Updated 7 years ago
- ☆349Updated 4 years ago
- Reconstruct process trees from event logs☆148Updated 4 years ago
- Python script to decode common encoded PowerShell scripts☆216Updated 6 years ago
- Lazy Office Analyzer☆119Updated 8 years ago
- Pafish Macro is a Macro enabled Office Document to detect malware analysis systems and sandboxes. It uses evasion & detection techniques …☆281Updated 7 years ago
- A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.☆169Updated last month
- Django web interface for managing Yara rules☆191Updated 6 years ago
- Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect …☆132Updated 2 years ago
- ☆134Updated 6 years ago
- PE Import Hash Generator☆75Updated 7 years ago
- Static based decoders for malware samples☆92Updated 4 years ago
- Some PowerShell Stuff☆282Updated 2 years ago
- A tool for de-obfuscating PowerShell scripts☆68Updated 5 years ago
- Windows Shortcut file (LNK) parser☆134Updated 2 years ago
- ☆275Updated last year
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆109Updated 4 years ago
- VolatilityBot – An automated memory analyzer for malware samples and memory dumps☆264Updated 3 years ago
- PowerShell No Agent Hunting☆110Updated 6 years ago
- Toolset for research malware and Cobalt Strike beacons☆209Updated 2 weeks ago
- IR-Tools - PowerShell tools for IR☆130Updated 7 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆214Updated 5 years ago
- Slides and reference material from Evading Autoruns presentation at DerbyCon 7 (September 2017)☆103Updated 4 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago
- All materials from our Black Hat 2018 "Subverting Sysmon" talk☆136Updated 6 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆115Updated 4 years ago
- Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.☆139Updated 7 years ago
- Automated Tactics Techniques & Procedures☆253Updated last year
- Page File analysis tools.☆126Updated 9 years ago