Alternatives and similar repositories for EVTX-ETW-Resources:

Users that are interested in EVTX-ETW-Resources are comparing it to the libraries listed below

• jsecurity101 / TelemetrySource
  ☆232Updated 9 months ago
• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆350Updated 2 years ago
• zeronetworks / rpcfirewall
  ☆492Updated 2 months ago
• gtworek / VolatileDataCollector
  ☆199Updated 3 months ago
• ion-storm / sysmon-edr
  Sysmon EDR POC Build within Powershell to prove ability.
  ☆219Updated 3 years ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆455Updated 3 months ago
• mandiant / SilkETW
  ☆752Updated last year
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆289Updated 2 weeks ago
• jdu2600 / Windows10EtwEvents
  Events from all manifest-based and mof-based ETW providers across Windows 10 versions
  ☆286Updated 9 months ago
• Neo23x0 / sysmon-config
  Sysmon configuration file template with default high-quality event tracing
  ☆471Updated last year
• jsecurity101 / MSRPC-to-ATTACK
  A repository that maps commonly used attacks using MSRPC protocols to ATT&CK
  ☆320Updated last year
• jsecurity101 / JonMon
  ☆206Updated 3 weeks ago
• LETHAL-FORENSICS / MemProcFS-Analyzer
  MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
  ☆585Updated this week
• microsoft / MSTIC-Sysmon
  Anything Sysmon related from the MSTIC R&D team
  ☆149Updated 8 months ago
• 3CORESec / MAL-CL
  MAL-CL (Malicious Command-Line)
  ☆309Updated 2 years ago
• OTRF / OSSEM-DM
  OSSEM Detection Model
  ☆175Updated 2 years ago
• 0xrawsec / gene
  Signature engine for all your logs
  ☆167Updated last year
• elastic / labs-releases
  Elastic Security Labs releases
  ☆57Updated 3 months ago
• libyal / winreg-kb
  Windows Registry Knowledge Base
  ☆171Updated 4 months ago
• Yamato-Security / hayabusa-rules
  Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
  ☆159Updated this week
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆731Updated 11 months ago
• netskopeoss / NetskopeThreatLabsIOCs
  ☆112Updated this week
• LETHAL-FORENSICS / Collect-MemoryDump
  Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR
  ☆225Updated this week
• The-DFIR-Report / Yara-Rules
  ☆65Updated this week
• mdecrevoisier / SIGMA-detection-rules
  Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques
  ☆346Updated last month
• BSI-Bund / RdpCacheStitcher
  RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
  ☆249Updated last year
• cyberark / RPCMon
  RPC Monitor tool based on Event Tracing for Windows
  ☆338Updated 6 months ago
• forensicxlab / VISION-ProcMon
  A ProcessMonitor visualization application written in rust.
  ☆178Updated last year
• strozfriedberg / cobaltstrike-config-extractor
  Cobalt Strike Beacon configuration extractor and parser.
  ☆150Updated 3 years ago
• kacos2000 / MFT_Browser
  $MFT directory tree reconstruction & FILE record info
  ☆298Updated 4 months ago