ion-storm / Graylog_Sysmon

Related projects: ⓘ

• MotiBa / Sysmon
  Sysmon configuration
  ☆66Updated 6 years ago
• glassdfir / SysmonMapper
  Maps process creation logged by Sysmon uses Google Org Chart API
  ☆24Updated 8 years ago
• neu5ron / WinLogsZero2Hero
  This is a repository from Adam Swan and I's presentation on Windows Logs Zero 2 Hero.
  ☆21Updated 6 years ago
• et0x / Incident-Response
  ☆36Updated 7 years ago
• MHaggis / sysmon-splunk-app
  Sysmon Splunk App
  ☆46Updated 6 years ago
• EnclaveConsulting / Windows-Services
  ☆39Updated this week
• oneoffdallas / check_ioc
  Check_ioc is a script to check for various, selectable indicators of compromise on Windows systems via PowerShell and Event Logs. It was …
  ☆76Updated 6 years ago
• MSAdministrator / PPRT
  This module is used to report phishing URLs to their WHOIS/RDAP abuse contact information.
  ☆42Updated 7 years ago
• EnclaveConsulting / Admin-Threats
  ☆71Updated this week
• hardwaterhacker / scandiff
  Scandiff is a PowerShell script to automate host discovery and scanning with nmap. After discovering and scanning hosts, scandiff perfor…
  ☆17Updated 9 years ago
• EnclaveConsulting / SANS-Slides
  ☆39Updated this week
• JamesHabben / sysmon-queries
  Queries to parse sysmon event log file with microsoft logparser
  ☆56Updated 9 years ago
• TKCERT / sysmon-config
  Sysmon configuration file template with default high-quality event tracing
  ☆17Updated 3 years ago
• n3l5 / irFARTpull
  PowerShell script utilized to pull several forensic artifacts from a live Win7 and WinXP system without WINRM.
  ☆49Updated 6 years ago
• MHaggis / app_splunk_sysmon_hunter
  Splunk App to assist Sysmon Threat Hunting
  ☆38Updated 7 years ago
• Cr0n1c / SCCM-Enumeration
  ☆37Updated 8 years ago
• olafhartong / SA-Threat-Hunting
  Splunk app for Threat hunting
  ☆15Updated 5 years ago
• curi0usJack / activedirectory
  This script runs several security checks and makes modifications (with your permission) to your Active Directory domain to improve it's s…
  ☆44Updated 8 years ago
• EnclaveConsulting / Crypto-PKI
  ☆55Updated this week
• BechtelCIRT / SplunkQueries
  ☆20Updated this week
• crypsisgroup / Splunkmon
  ☆18Updated this week
• NotAwful / Sysmon-DSC
  ☆17Updated this week
• olafhartong / TA-Sysmon-deploy
  Deploy and maintain Symon through the Splunk Deployment Sever
  ☆31Updated 4 years ago
• EnclaveConsulting / SANS-Misc
  ☆26Updated this week
• giMini / NOAH
  PowerShell No Agent Hunting
  ☆107Updated 6 years ago
• opensourcesec / cblrconsole
  Carbonblack Live Response from the comfort of your own terminal
  ☆20Updated 8 years ago
• tenable / Posh-Nessus
  PowerShell Module for automating Tenable Nessus Vulnerability Scanner.
  ☆88Updated last year
• Jrotenberger / CBIRAutomation
  CB API scripts for IR, administration, etc.
  ☆33Updated 5 years ago
• Asymmetric-InfoSec / Power-Response
  Powering Up Incident Response with Power-Response
  ☆62Updated 4 years ago
• Invoke-IR / WmiEvent
  A PowerShell module to abstract the complexities of Permanent WMI Event Subscriptions
  ☆54Updated 8 years ago