williballenthin / python-evtxLinks
Pure Python parser for Windows Event Log files (.evtx)
☆749Updated last week
Alternatives and similar repositories for python-evtx
Users that are interested in python-evtx are comparing it to the libraries listed below
Sorting:
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆921Updated last year
- ☆1,074Updated 6 years ago
- A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.☆687Updated 3 weeks ago
- yarGen is a generator for YARA rules☆1,657Updated 2 months ago
- A Powershell incident response framework☆1,607Updated 2 years ago
- Pure Python parser for Windows Registry hives.☆430Updated 5 months ago
- ☆509Updated 4 years ago
- Noriben - Portable, Simple, Malware Analysis Sandbox☆1,161Updated 2 months ago
- Utilities for Sysmon☆1,529Updated 3 months ago
- Investigate suspicious activity by visualizing Sysmon's event log☆423Updated last year
- Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into …☆806Updated last year
- Volatility plugins developed and maintained by the community☆364Updated 4 years ago
- CyLR - Live Response Collection Tool☆682Updated 3 years ago
- ☆428Updated 2 years ago
- PowerForensics provides an all in one platform for live disk forensic analysis☆1,403Updated last year
- A Fast (and safe) parser for the Windows XML Event Log (EVTX) format☆763Updated 3 months ago
- Digital Forensics artifact repository☆1,130Updated 6 months ago
- analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…☆481Updated 8 months ago
- RDP Bitmap Cache parser☆539Updated 5 months ago
- A set of Zeek scripts to detect ATT&CK techniques.☆595Updated last year
- FAME Automates Malware Evaluation☆900Updated 2 months ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆424Updated 4 years ago
- Configuration files for the SOF-ELK VM☆1,597Updated this week
- ☆304Updated 4 years ago
- Indicators from Unit 42 Public Reports☆714Updated last month
- PowerShell Obfuscation Detection Framework☆740Updated last year
- Online hash checker for Virustotal and other services☆829Updated 3 months ago
- Utilities for MITRE™ ATT&CK☆1,032Updated last year
- RegRipper3.0☆617Updated 6 months ago
- Tool to extract indicators of compromise from security reports in PDF format☆436Updated 2 years ago