libyal / libevtLinks
Library and tools to access the Windows Event Log (EVT) format
☆60Updated last year
Alternatives and similar repositories for libevt
Users that are interested in libevt are comparing it to the libraries listed below
Sorting:
- Modified edition of cuckoomon☆49Updated 7 years ago
- zer0m0n driver for cuckoo sandbox☆88Updated 9 years ago
- Work Fast With the pattern matching swiss knife for malware researchers.☆38Updated 9 years ago
- Various Yara signatures (possibly to be included in a release later).☆86Updated 6 years ago
- Volatility memory forensics plugin for extracting Windows DNS Cache☆29Updated 8 years ago
- CAPE monitor DLLs☆41Updated 5 years ago
- Modified edition of cuckoo community modules☆32Updated 5 years ago
- Analysis PE file or Shellcode☆50Updated 9 years ago
- YARA rules for use with ProcFilter☆87Updated 8 years ago
- ☆13Updated 9 years ago
- Automatically exported from code.google.com/p/verify-sigs☆18Updated 8 years ago
- Simple NTFS crawler.☆56Updated 8 years ago
- Network detector for Winnti malware☆20Updated 7 years ago
- Pure Python parser for data encoded by .NET's BinaryFormatter☆52Updated 6 years ago
- Handy scripts to speed up malware analysis☆35Updated last year
- Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research☆53Updated 7 years ago
- Tools for parsing rulesets using the exact grammar as YARA. Written in Go.☆85Updated 2 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆76Updated 10 years ago
- Tool to decompress data from Windows 10 page files and memory dumps, that has been compressed by the Windows 10 memory manager.☆51Updated 6 years ago
- An NTFS journal parser☆82Updated 9 years ago
- a collection of yara rules for binary analysis☆24Updated 8 years ago
- QEMU with rVMI extensions☆25Updated 8 years ago
- Recover event log entries from an image by heurisitically looking for record structures.☆27Updated 9 years ago
- Command-line Interface for Binar.ly☆38Updated 8 years ago
- Test suite for bypassing Malware sandboxes.☆39Updated 10 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆108Updated 4 years ago
- Yara rules for quick reverse engineering of malware.☆19Updated 9 years ago
- Extract GUIDs from .NET assemblies☆21Updated 9 years ago
- ☆42Updated 6 years ago
- Emulating Virtual Environment to stay protected against advanced malware☆100Updated 6 years ago