omerbenamram / winstructsLinks
Parsers for common structures across windows formats.
☆12Updated 2 years ago
Alternatives and similar repositories for winstructs
Users that are interested in winstructs are comparing it to the libraries listed below
Sorting:
- lnk_parser is a full rust implementation to parse windows LNK files☆22Updated 6 months ago
- Manage Your Large Team of Consultants☆11Updated 4 months ago
- Wrapper for TSK (Sleuth Kit) Bindings☆12Updated 3 years ago
- ☆33Updated 3 years ago
- This script will generate hashes (MD5, SHA1, SHA256), submit the MD5 to Virus Total, and produce a text file with the results.☆15Updated 2 years ago
- USN to JSON☆22Updated 5 years ago
- Parser for Sdba memory pool tags☆21Updated 4 years ago
- ☆36Updated 3 years ago
- This is a repo for fetching Applocker event log by parsing the win-event log☆31Updated 3 years ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆12Updated last year
- ☆24Updated 10 months ago
- A pure PowerShell/ .NET DFIR capability that dumps the Windows SRUM (System Resource Usage Monitor) database to CSVs for analysis.☆14Updated 4 years ago
- A powershell parser for https://github.com/ufrisk/MemProcFS☆45Updated 4 years ago
- NTFS Security Descriptor Stream ($Secure:$SDS) parser☆14Updated 3 years ago
- $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility☆38Updated last year
- Hundred Days of Yara Challenge☆12Updated 3 years ago
- NTFS file system specimens☆13Updated 2 years ago
- Indicators of Normality☆11Updated 3 years ago
- Windows Thingies... but in Rust☆23Updated 3 years ago
- CLI tool to compute the TypeRefHash for .NET binaries.☆19Updated 4 years ago
- Windows registry samples☆24Updated 7 years ago
- ☆20Updated last year
- Collection of generic YARA rules☆16Updated 5 months ago
- Browse Windows Prefetch versions: 17,23,26,30v1/2,31 & some of SuperFetch .7db/.db's☆64Updated last year
- Windows.EDB Browser☆60Updated 2 years ago
- Defeating Anti-Debugging Techniques for Malware Analysis☆13Updated 3 years ago
- Repository for LNK stuff☆31Updated 3 years ago
- Crowdstrike Falcon Host script for iterating through instances to get alert and other relevant data☆13Updated 6 years ago
- Python CLI covering the FileScan.IO API - enabling automatic interaction with www.filescan.io or private instances☆16Updated 6 months ago
- Epimitheus is a tool that uses graphical database Neo4j for Windows Events visualization.☆19Updated 3 years ago