Alternatives and similar repositories for libesedb

Users that are interested in libesedb are comparing it to the libraries listed below

• mandiant / flare-wmi
  ☆432Updated 2 years ago
• kavika13 / RemCom
  Remote Command Executor: A OSS replacement for PsExec and RunAs - or Telnet without having to install a server. Take your pick :)
  ☆366Updated 8 years ago
• jschicht / RawCopy
  Commandline low level file extractor for NTFS
  ☆306Updated 6 years ago
• csababarta / ntdsxtract
  Active Directory forensic framework
  ☆332Updated 3 years ago
• williballenthin / python-registry
  Pure Python parser for Windows Registry hives.
  ☆440Updated last year
• libyal / libevtx
  Library and tools to access the Windows XML Event Log (EVTX) format
  ☆226Updated last month
• leechristensen / UnmanagedPowerShell
  Executes PowerShell from an unmanaged process
  ☆521Updated 9 years ago
• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆749Updated 2 years ago
• msuhanov / regf
  Windows registry file format specification
  ☆354Updated 7 years ago
• ctxis / RDP-Replay
  Replay RDP traffic from PCAP
  ☆200Updated 6 years ago
• volatilityfoundation / community
  Volatility plugins developed and maintained by the community
  ☆375Updated 4 years ago
• R3MRUM / PSDecode
  PowerShell script for deobfuscating encoded PowerShell scripts
  ☆433Updated 5 years ago
• enigma0x3 / Misc-PowerShell-Stuff
  random powershell goodness
  ☆460Updated last year
• mandiant / ShimCacheParser
  ☆280Updated 2 years ago
• williballenthin / INDXParse
  Tool suite for inspecting NTFS artifacts.
  ☆225Updated 2 years ago
• RedSiege / WMIOps
  This repo is for WMIOps, a powershell script which uses WMI for various purposes across a network.
  ☆388Updated last year
• realparisi / WMI_Monitor
  Log newly created WMI consumers and processes to the Windows Application event log
  ☆124Updated 7 years ago
• jschicht / UsnJrnl2Csv
  Parser for $UsnJrnl on NTFS
  ☆119Updated 3 years ago
• fox-it / danderspritz-evtx
  Parse evtx files and detect use of the DanderSpritz eventlogedit module
  ☆151Updated 8 years ago
• jaredcatkinson / PSReflect-Functions
  Module to provide PowerShell functions that abstract Win32 API functions
  ☆250Updated last year
• mandiant / SilkETW
  ☆823Updated 2 years ago
• godaddy / procfilter
  A YARA-integrated process denial framework for Windows
  ☆397Updated 5 years ago
• two06 / Inception
  Provides In-memory compilation and reflective loading of C# apps for AV evasion.
  ☆372Updated last year
• RedSiege / WMImplant
  This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported …
  ☆838Updated last year
• mattifestation / PSSysmonTools
  Sysmon Tools for PowerShell
  ☆232Updated 7 years ago
• poweradminllc / PAExec
  Remote execution, like PsExec
  ☆605Updated 11 months ago
• Invoke-IR / Uproot
  Currently not updated for WMIEvent module...
  ☆262Updated 9 years ago
• jschicht / LogFileParser
  Parser for $LogFile on NTFS
  ☆212Updated 8 months ago
• NetSPI / PESecurity
  PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.
  ☆662Updated last year
• gleeda / memtriage
  Allows you to quickly query a Windows machine for RAM artifacts
  ☆218Updated 5 years ago