olafhartong / sysmon-parser
Automatically generated Sysmon parser for Azure Sentinel
☆16Updated this week
Alternatives and similar repositories for sysmon-parser:
Users that are interested in sysmon-parser are comparing it to the libraries listed below
- Azure AD Incident Response☆25Updated 3 years ago
- Threat Mitigation Strategies☆25Updated last year
- PowerShell 'Hero': scripts for DFIR and automation with a PowerShell menu example.☆36Updated last year
- Random PowerShell Scripts☆16Updated 3 years ago
- Defensive-oriented Active Directory enumeration☆23Updated 9 years ago
- These are some of the commands which I use frequently during Malware Analysis and DFIR.☆24Updated last year
- A project that aims to automate Volatility3 at scale with the use of cloud strength and the power of KQL inside ADX.☆16Updated 2 months ago
- Winterfell hunt is a python script to perform auto threat hunting for malicious activities in windows OS based on collected data by winte…☆15Updated 4 years ago
- Specific guidance and configuration scripts based on Microsoft-recommended security configuration baselines for Windows.☆13Updated 4 years ago
- Cmdlets for capturing Windows Events☆14Updated 2 years ago
- Go module that allows you to authenticate to Azure with a well known client ID using interactive logon and grab the token☆25Updated 2 years ago
- Assist analyst and threat hunters to understand Windows authentication logs and to analyze brutforce scenarios.☆18Updated last year
- Creates an ATT&CK Navigator map of an Adversary Emulation Plan☆17Updated 3 years ago
- Resource links (video, slides & code) for my conference talks | presentations | workshops☆13Updated last month
- PowerShell script useful for Incident Response and security/configuration baselines for Windows Vista and later☆20Updated 8 years ago
- Windows Security Logging☆43Updated 2 years ago
- Windows 10 Live Information viewer☆36Updated 3 years ago
- A set of tools for collecting forensic information☆26Updated 4 years ago
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Updated 2 weeks ago
- incident response scripts☆19Updated 5 years ago
- ☆22Updated 2 years ago
- Parser for Sdba memory pool tags☆17Updated 3 years ago
- Parser for Windows PowerShell script block logs☆13Updated last month
- ☆31Updated 3 months ago
- Microsoft GPO Readiness Lateral Movement Detection Tool☆16Updated 2 years ago
- This script will generate hashes (MD5, SHA1, SHA256), submit the MD5 to Virus Total, and produce a text file with the results.☆15Updated last year
- Visual Studio Code Microsoft Sysinternal Sysmon configuration file extension.☆51Updated last year
- ☆10Updated last year
- Active Directory Group Policy analyzer☆14Updated 5 years ago
- Incident Response Report Using GitHub-Sphinx☆19Updated 5 years ago