Alternatives and similar repositories for EVTX-ETW-Resources:

Users that are interested in EVTX-ETW-Resources are comparing it to the libraries listed below

• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆352Updated 2 years ago
• jsecurity101 / TelemetrySource
  ☆236Updated 10 months ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆466Updated 5 months ago
• zeronetworks / rpcfirewall
  ☆498Updated 3 months ago
• jdu2600 / Windows10EtwEvents
  Events from all manifest-based and mof-based ETW providers across Windows 10 versions
  ☆289Updated 10 months ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆296Updated 2 weeks ago
• ion-storm / sysmon-edr
  Sysmon EDR POC Build within Powershell to prove ability.
  ☆223Updated 3 years ago
• jsecurity101 / MSRPC-to-ATTACK
  A repository that maps commonly used attacks using MSRPC protocols to ATT&CK
  ☆322Updated last year
• mandiant / SilkETW
  ☆758Updated last year
• gtworek / VolatileDataCollector
  ☆200Updated 5 months ago
• kacos2000 / MFT_Browser
  $MFT directory tree reconstruction & FILE record info
  ☆303Updated 5 months ago
• Neo23x0 / YARA-Performance-Guidelines
  A guide on how to write fast and memory friendly YARA rules
  ☆141Updated last month
• LETHAL-FORENSICS / Collect-MemoryDump
  Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR
  ☆235Updated 3 weeks ago
• repnz / etw-providers-docs
  Document ETW providers
  ☆225Updated 5 years ago
• Neo23x0 / sysmon-config
  Sysmon configuration file template with default high-quality event tracing
  ☆478Updated last year
• strozfriedberg / cobaltstrike-config-extractor
  Cobalt Strike Beacon configuration extractor and parser.
  ☆153Updated 3 years ago
• cyberark / RPCMon
  RPC Monitor tool based on Event Tracing for Windows
  ☆341Updated 7 months ago
• microsoft / MSTIC-Sysmon
  Anything Sysmon related from the MSTIC R&D team
  ☆151Updated 9 months ago
• marcosd4h / sysmonx
  SysmonX - An Augmented Drop-In Replacement of Sysmon
  ☆214Updated 5 years ago
• pan-unit42 / tweets
  ☆130Updated last year
• libyal / winreg-kb
  Windows Registry Knowledge Base
  ☆173Updated 5 months ago
• roadwy / DefenderYara
  Extracted Yara rules from Windows Defender mpavbase and mpasbase
  ☆378Updated last month
• OTRF / OSSEM-DM
  OSSEM Detection Model
  ☆177Updated 2 years ago
• jsecurity101 / JonMon
  ☆216Updated 2 months ago
• Karneades / malware-persistence
  Collection of malware persistence and hunting information. Be a persistent persistence hunter!
  ☆177Updated 2 months ago
• 0xrawsec / gene
  Signature engine for all your logs
  ☆166Updated last year
• Yamato-Security / hayabusa-rules
  Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
  ☆166Updated this week
• elastic / labs-releases
  Elastic Security Labs releases
  ☆61Updated this week
• StrangerealIntel / Orion
  A YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses ...
  ☆139Updated last year
• LETHAL-FORENSICS / MemProcFS-Analyzer
  MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
  ☆609Updated 3 weeks ago