omerbenamram / winstructsLinks
Parsers for common structures across windows formats.
☆12Updated 2 years ago
Alternatives and similar repositories for winstructs
Users that are interested in winstructs are comparing it to the libraries listed below
Sorting:
- lnk_parser is a full rust implementation to parse windows LNK files☆22Updated 6 months ago
- Wrapper for TSK (Sleuth Kit) Bindings☆12Updated 3 years ago
- Manage Your Large Team of Consultants☆11Updated 4 months ago
- ☆33Updated 3 years ago
- ☆24Updated 10 months ago
- USN to JSON☆22Updated 5 years ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆12Updated last year
- This script will generate hashes (MD5, SHA1, SHA256), submit the MD5 to Virus Total, and produce a text file with the results.☆15Updated 2 years ago
- Parser for Sdba memory pool tags☆20Updated 4 years ago
- ☆36Updated 3 years ago
- NTFS Security Descriptor Stream ($Secure:$SDS) parser☆14Updated 3 years ago
- Hundred Days of Yara Challenge☆12Updated 3 years ago
- This is a repo for fetching Applocker event log by parsing the win-event log☆31Updated 3 years ago
- A document tagging library☆33Updated 10 months ago
- NTFS file system specimens☆13Updated 2 years ago
- $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility☆38Updated last year
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Updated 11 months ago
- Windows file metadata / forensic tool.☆18Updated 3 months ago
- A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.☆14Updated 4 years ago
- Windows.EDB Browser☆60Updated 2 years ago
- Go implementation of an Extensible Storage Engine parser☆32Updated 11 months ago
- Just Another broken Registry Parser (JARP)☆16Updated last year
- Indicators of Normality☆11Updated 3 years ago
- Windows registry samples☆24Updated 7 years ago
- Timestomper and Timestamp checker with nanosecond accuracy for NTFS volumes☆51Updated 4 years ago
- Modular malware analysis artifact collection and correlation framework☆53Updated last year
- CLI tool to compute the TypeRefHash for .NET binaries.☆19Updated 4 years ago
- Imphash-like calculation on Golang binaries☆49Updated 3 years ago
- Here are some tools I developed to help analyze malware☆12Updated 2 years ago
- Forensic framework to build tools that can be reused in multiple projects without changing anything☆32Updated 3 months ago