nasbench / EVTX-ETW-ResourcesLinks
Event Tracing For Windows (ETW) Resources
☆391Updated 9 months ago
Alternatives and similar repositories for EVTX-ETW-Resources
Users that are interested in EVTX-ETW-Resources are comparing it to the libraries listed below
Sorting:
- ☆251Updated last year
- ☆520Updated last month
- Sysmon-Like research tool for ETW☆353Updated 2 years ago
- C# based evtx parser with lots of extras☆314Updated 2 weeks ago
- View ETW Provider manifest☆502Updated 8 months ago
- ☆203Updated 8 months ago
- Sysmon EDR POC Build within Powershell to prove ability.☆225Updated 4 years ago
- $MFT directory tree reconstruction & FILE record info☆306Updated 9 months ago
- ☆234Updated last month
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆649Updated 3 weeks ago
- Cobalt Strike Beacon configuration extractor and parser.☆154Updated 3 years ago
- RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.☆273Updated last year
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆723Updated 3 months ago
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆242Updated 3 months ago
- Sysmon configuration file template with default high-quality event tracing☆495Updated last week
- MAL-CL (Malicious Command-Line)☆314Updated 2 years ago
- ☆777Updated 2 years ago
- Encyclopedia for Executables☆447Updated 3 years ago
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆302Updated last year
- Collection of malware persistence and hunting information. Be a persistent persistence hunter!☆179Updated last week
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆120Updated 6 months ago
- A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …☆168Updated 7 months ago
- #ThreatHunting #DFIR #Malware #Detection Mind Maps☆298Updated 3 years ago
- Extracted Yara rules from Windows Defender mpavbase and mpasbase☆438Updated 2 months ago
- Lnk Explorer Command line edition!!☆312Updated 6 months ago
- Anything Sysmon related from the MSTIC R&D team☆154Updated last year
- Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.☆581Updated 6 months ago
- Collection of private Yara rules.☆358Updated 3 months ago
- ☆137Updated 3 weeks ago
- Detect and respond to Cobalt Strike beacons using ETW.☆502Updated 3 years ago