omerbenamram / winstructsLinks
Parsers for common structures across windows formats.
☆12Updated last year
Alternatives and similar repositories for winstructs
Users that are interested in winstructs are comparing it to the libraries listed below
Sorting:
- lnk_parser is a full rust implementation to parse windows LNK files☆20Updated last month
- Wrapper for TSK (Sleuth Kit) Bindings☆12Updated 2 years ago
- Manage Your Large Team of Consultants☆11Updated this week
- Parser for Sdba memory pool tags☆18Updated 4 years ago
- ☆21Updated 4 months ago
- Windows file metadata / forensic tool.☆18Updated this week
- ☆33Updated 3 years ago
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆46Updated 2 years ago
- A document tagging library☆30Updated 4 months ago
- Hundred Days of Yara Challenge☆12Updated 3 years ago
- Automatic/Custom Destinations & LNK (MS-SHLLINK) Browser☆34Updated last year
- This is a repo for fetching Applocker event log by parsing the win-event log☆31Updated 3 years ago
- NTFS file system specimens☆13Updated 2 years ago
- USN to JSON☆22Updated 5 years ago
- This script will generate hashes (MD5, SHA1, SHA256), submit the MD5 to Virus Total, and produce a text file with the results.☆15Updated 2 years ago
- General Content☆26Updated last year
- ☆34Updated 2 years ago
- NTFS Security Descriptor Stream ($Secure:$SDS) parser☆14Updated 2 years ago
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Updated 2 years ago
- NTFS samples☆25Updated 5 years ago
- Just Another broken Registry Parser (JARP)☆16Updated last year
- Imphash-like calculation on Golang binaries☆49Updated 3 years ago
- Windows.EDB Browser☆57Updated 2 years ago
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Updated 6 months ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆12Updated 11 months ago
- Yara rules☆22Updated 2 years ago
- Splunk Technology-AddOn for Aurora Sigma-Based EDR Agent. It helps parse and configure the necessary inputs to neatly consume Aurora EDR …☆13Updated 2 years ago
- a tiny program to consume from ETW providers for research☆50Updated 7 months ago
- $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility☆37Updated last year
- A powershell parser for https://github.com/ufrisk/MemProcFS☆44Updated 4 years ago