libyal / libevt
Library and tools to access the Windows Event Log (EVT) format
☆59Updated 9 months ago
Alternatives and similar repositories for libevt:
Users that are interested in libevt are comparing it to the libraries listed below
- Various Yara signatures (possibly to be included in a release later).☆85Updated 5 years ago
- Modified edition of cuckoomon☆49Updated 6 years ago
- An NTFS journal parser☆82Updated 9 years ago
- Library and tools to access the Windows Prefetch File (SCCA) format.☆73Updated 3 months ago
- zer0m0n driver for cuckoo sandbox☆87Updated 8 years ago
- Windows registry samples☆23Updated 6 years ago
- Work Fast With the pattern matching swiss knife for malware researchers.☆38Updated 9 years ago
- NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl☆37Updated 8 years ago
- Command-line Interface for Binar.ly☆37Updated 8 years ago
- Simple NTFS crawler.☆56Updated 7 years ago
- DEPRECATED - replaced with "monitor"☆122Updated 9 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆75Updated 10 years ago
- CAPE monitor DLLs☆39Updated 5 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆109Updated 4 years ago
- YARA rules for use with ProcFilter☆86Updated 7 years ago
- Pure Python parser for data encoded by .NET's BinaryFormatter☆50Updated 6 years ago
- Telsy CTI Research Team☆57Updated 4 years ago
- Modified edition of cuckoo community modules☆32Updated 5 years ago
- Tool to decompress data from Windows 10 page files and memory dumps, that has been compressed by the Windows 10 memory manager.☆50Updated 6 years ago
- Binary commandline executable to parse ETL files☆67Updated 6 years ago
- A Rekall interactive document for a Memory Analysis workshop/course.☆43Updated 8 years ago
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆38Updated 2 years ago
- Library and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files☆16Updated 9 months ago
- PE Import Hash Generator☆78Updated 7 years ago
- openioc_scan Volatility Framework plugin☆43Updated 9 years ago
- Server for receiving autorun data from the clients☆13Updated 7 years ago
- A mapping of used malware names to commonly known family names☆62Updated 2 years ago
- Extract compressed memory pages from page-aligned data☆45Updated 6 years ago
- Handy scripts to speed up malware analysis☆35Updated last year
- Yet another registry parser☆132Updated 3 years ago