libyal / libesedb

Related projects: ⓘ

• jschicht / RawCopy
  Commandline low level file extractor for NTFS
  ☆272Updated 5 years ago
• mandiant / flare-wmi
  ☆415Updated last year
• csababarta / ntdsxtract
  Active Directory forensic framework
  ☆312Updated 2 years ago
• libyal / libevtx
  Library and tools to access the Windows XML Event Log (EVTX) format
  ☆188Updated 2 months ago
• kavika13 / RemCom
  Remote Command Executor: A OSS replacement for PsExec and RunAs - or Telnet without having to install a server. Take your pick :)
  ☆336Updated 6 years ago
• mandiant / ShimCacheParser
  ☆271Updated last year
• leechristensen / UnmanagedPowerShell
  Executes PowerShell from an unmanaged process
  ☆466Updated 8 years ago
• godaddy / procfilter
  A YARA-integrated process denial framework for Windows
  ☆395Updated 4 years ago
• msuhanov / regf
  Windows registry file format specification
  ☆319Updated 5 years ago
• mandiant / SilkETW
  ☆723Updated last year
• williballenthin / INDXParse
  Tool suite for inspecting NTFS artifacts.
  ☆213Updated 10 months ago
• SekoiaLab / Fastir_Collector
  ☆505Updated 3 years ago
• volatilityfoundation / community
  Volatility plugins developed and maintained by the community
  ☆339Updated 3 years ago
• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆719Updated 9 months ago
• rowingdude / analyzeMFT
  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…
  ☆429Updated this week
• williballenthin / python-registry
  Pure Python parser for Windows Registry hives.
  ☆425Updated 9 months ago
• Ben0xA / nps
  Not PowerShell
  ☆441Updated 7 years ago
• danielbohannon / Invoke-CradleCrafter
  PowerShell Remote Download Cradle Generator & Obfuscator
  ☆817Updated 6 years ago
• EricZimmerman / Registry
  Full featured, offline Registry parser in C#
  ☆218Updated 2 weeks ago
• EricZimmerman / LECmd
  Lnk Explorer Command line edition!!
  ☆261Updated 3 months ago
• CiscoCXSecurity / creddump7
  ☆379Updated 3 years ago
• enigma0x3 / Misc-PowerShell-Stuff
  random powershell goodness
  ☆440Updated 5 years ago
• NetSPI / PESecurity
  PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.
  ☆621Updated last month
• libyal / libyal
  Yet another library library (and tools)
  ☆201Updated last week
• bontchev / pcodedmp
  A VBA p-code disassembler
  ☆450Updated 3 years ago
• keydet89 / RegRipper2.8
  ☆375Updated this week
• R3MRUM / PSDecode
  PowerShell script for deobfuscating encoded PowerShell scripts
  ☆416Updated 3 years ago
• jschicht / Mft2Csv
  Extract $MFT record info and log it to a csv file.
  ☆254Updated 9 months ago
• BayshoreNetworks / yextend
  Yara integrated software to handle archive file data.
  ☆296Updated 2 years ago
• pwndizzle / CodeExecutionOnWindows
  A list of ways to execute code on Windows using legitimate Windows tools
  ☆301Updated 5 years ago