libyal / esedb-kbLinks
Extensible Storage Engine (ESE) Database File Knowledge Base
☆45Updated 2 weeks ago
Alternatives and similar repositories for esedb-kb
Users that are interested in esedb-kb are comparing it to the libraries listed below
Sorting:
- Event metadata collected across all manifest-based ETW providers on Window 10 1903☆31Updated 6 years ago
- Windows Registry Knowledge Base☆190Updated 2 weeks ago
- Binary commandline executable to parse ETL files☆68Updated 7 years ago
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆50Updated 2 months ago
- A PowerShell module to assist in parsing and managing catalog files.☆22Updated 8 years ago
- Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.☆115Updated 11 months ago
- SysInternals' Process Monitor filters repository - collected from various places and made up by myself. To be used for quick Behavioral a…☆70Updated 4 years ago
- ☆18Updated 12 years ago
- Parses the WMI object database....looking for persistence☆34Updated 6 years ago
- Windows registry samples☆24Updated 7 years ago
- Decode security descriptors in $Secure on NTFS☆21Updated 3 years ago
- Registry Explorer bookmark definitions☆44Updated last year
- Library and tools to access the Windows Prefetch File (SCCA) format.☆81Updated 2 weeks ago
- PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.☆40Updated 3 years ago
- Trace ScriptBlock execution for powershell v2☆40Updated 5 years ago
- ☆71Updated 4 months ago
- Repository of tools, YARA rules, and code-snippets from Stairwell's research team.☆23Updated last year
- Parse Microsoft shim databases☆31Updated 11 months ago
- ☆33Updated last year
- An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree…☆60Updated 7 years ago
- Simple Powershell scripts to collect all Windows Event Logs from a host and parse them into one CSV timeline.☆32Updated 7 years ago
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆19Updated last year
- Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)☆195Updated 2 years ago
- Lnk file parser☆90Updated 7 months ago
- Get USB Devices from Registry hives☆22Updated 4 years ago
- Visual Studio Code Microsoft Sysinternal Sysmon configuration file extension.☆54Updated 2 years ago
- Parser for $UsnJrnl on NTFS☆118Updated 3 years ago
- A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies☆63Updated 2 years ago
- Yet another registry parser☆138Updated 3 years ago
- Automated forensics written in PowerShell☆34Updated 6 years ago