Alternatives and similar repositories for EVTX-ETW-Resources

Users that are interested in EVTX-ETW-Resources are comparing it to the libraries listed below

• jonny-jhnson / TelemetrySource
  ☆257Updated last year
• zeronetworks / rpcfirewall
  ☆529Updated 6 months ago
• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆370Updated 3 years ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆337Updated 3 months ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆550Updated last year
• gtworek / VolatileDataCollector
  ☆211Updated last week
• ion-storm / sysmon-edr
  Sysmon EDR POC Build within Powershell to prove ability.
  ☆225Updated 4 years ago
• kacos2000 / MFT_Browser
  $MFT directory tree reconstruction & FILE record info
  ☆321Updated last year
• jonny-jhnson / JonMon
  ☆246Updated 6 months ago
• jdu2600 / Windows10EtwEvents
  Events from all manifest-based and mof-based ETW providers across Windows 10 versions
  ☆319Updated last year
• microsoft / MSTIC-Sysmon
  Anything Sysmon related from the MSTIC R&D team
  ☆155Updated last year
• NextronSystems / sysmon-config
  Sysmon configuration file template with default high-quality event tracing
  ☆538Updated this week
• LETHAL-FORENSICS / MemProcFS-Analyzer
  MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
  ☆688Updated last month
• strozfriedberg / cobaltstrike-config-extractor
  Cobalt Strike Beacon configuration extractor and parser.
  ☆157Updated last month
• EricZimmerman / AppCompatCacheParser
  AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10, and Windows 11
  ☆126Updated 10 months ago
• Yamato-Security / hayabusa-rules
  Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
  ☆211Updated this week
• EricZimmerman / LECmd
  Lnk Explorer Command line edition!!
  ☆331Updated 11 months ago
• 3CORESec / MAL-CL
  MAL-CL (Malicious Command-Line)
  ☆320Updated 2 years ago
• EricZimmerman / AmcacheParser
  Parses amcache.hve files, but with a twist!
  ☆144Updated 10 months ago
• mandiant / SilkETW
  ☆808Updated 2 years ago
• BSI-Bund / RdpCacheStitcher
  RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
  ☆301Updated 2 years ago
• mdecrevoisier / EVTX-to-MITRE-Attack
  Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
  ☆599Updated 10 months ago
• nasbench / MindMaps
  #ThreatHunting #DFIR #Malware #Detection Mind Maps
  ☆305Updated 4 years ago
• EricZimmerman / MFTECmd
  Parses $MFT from NTFS file systems
  ☆281Updated 7 months ago
• strontic / xcyclopedia
  Encyclopedia for Executables
  ☆462Updated 4 years ago
• AndrewRathbun / VanillaWindowsReference
  A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …
  ☆183Updated last month
• LETHAL-FORENSICS / Collect-MemoryDump
  Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR
  ☆251Updated last month
• mdecrevoisier / SIGMA-detection-rules
  Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques
  ☆402Updated last month
• forensicxlab / VISION-ProcMon
  A ProcessMonitor visualization application written in rust.
  ☆184Updated 2 years ago
• elastic / labs-releases
  Elastic Security Labs releases
  ☆81Updated 2 weeks ago