williballenthin / python-evtxLinks
Pure Python parser for Windows Event Log files (.evtx)
☆748Updated last month
Alternatives and similar repositories for python-evtx
Users that are interested in python-evtx are comparing it to the libraries listed below
Sorting:
- analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…☆477Updated 7 months ago
- Pure Python parser for Windows Registry hives.☆430Updated 4 months ago
- Super timeline all the things☆1,860Updated this week
- PowerForensics provides an all in one platform for live disk forensic analysis☆1,401Updated last year
- ☆508Updated 4 years ago
- Volatility plugins developed and maintained by the community☆362Updated 4 years ago
- Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into …☆803Updated last year
- Regipy is an os independent python library for parsing offline registry hives☆257Updated last month
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆918Updated last year
- A VBA parser and emulation engine to analyze malicious macros.☆1,092Updated 10 months ago
- ☆276Updated 2 years ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆424Updated 4 years ago
- yarGen is a generator for YARA rules☆1,647Updated last month
- PowerShell Obfuscation Detection Framework☆735Updated last year
- ☆428Updated 2 years ago
- ☆302Updated 4 years ago
- Web App for Volatility framework☆381Updated 6 months ago
- A Powershell incident response framework☆1,603Updated 2 years ago
- A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.☆672Updated last month
- A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.☆482Updated 4 years ago
- RDP Bitmap Cache parser☆537Updated 4 months ago
- A set of Zeek scripts to detect ATT&CK techniques.☆593Updated 11 months ago
- RegRipper3.0☆612Updated 5 months ago
- CyLR - Live Response Collection Tool☆680Updated 3 years ago
- Digital Forensics artifact repository☆1,118Updated 5 months ago
- Investigate suspicious activity by visualizing Sysmon's event log☆422Updated last year
- Digital forensic acquisition tool for Windows based incident response.☆341Updated last year
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆717Updated 2 months ago
- Utilities for Sysmon☆1,527Updated 3 months ago
- PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted da…☆486Updated 7 years ago