williballenthin / python-evtxLinks
Pure Python parser for Windows Event Log files (.evtx)
☆758Updated 6 months ago
Alternatives and similar repositories for python-evtx
Users that are interested in python-evtx are comparing it to the libraries listed below
Sorting:
- Pure Python parser for Windows Registry hives.☆439Updated 11 months ago
- analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…☆516Updated 5 months ago
- Volatility plugins developed and maintained by the community☆375Updated 4 years ago
- A VBA parser and emulation engine to analyze malicious macros.☆1,115Updated last year
- PowerShell script for deobfuscating encoded PowerShell scripts☆431Updated 4 years ago
- Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into …☆816Updated 2 years ago
- PowerShell Obfuscation Detection Framework☆750Updated 2 years ago
- A Powershell incident response framework☆1,632Updated 3 years ago
- yarGen is a generator for YARA rules☆1,766Updated this week
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆934Updated 2 years ago
- Noriben - Portable, Simple, Malware Analysis Sandbox☆1,219Updated 5 months ago
- ☆518Updated 4 years ago
- ☆1,090Updated 6 years ago
- Indicators from Unit 42 Public Reports☆727Updated 4 months ago
- A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.☆731Updated 7 months ago
- RDP Bitmap Cache parser☆628Updated 11 months ago
- Yara Rule Analyzer and Statistics☆397Updated 2 years ago
- ☆431Updated 2 years ago
- ☆280Updated 2 years ago
- Online hash checker for Virustotal and other services☆841Updated 9 months ago
- The Python interface for YARA☆723Updated 7 months ago
- Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsac…☆882Updated 5 years ago
- Investigate suspicious activity by visualizing Sysmon's event log☆429Updated 2 years ago
- A set of Zeek scripts to detect ATT&CK techniques.☆616Updated last year
- Volatility plugin for extracts configuration data of known malware☆494Updated 2 years ago
- CyLR - Live Response Collection Tool☆705Updated 3 years ago
- Tool Analysis Result Sheet☆356Updated 8 years ago
- Digital Forensics artifact repository☆1,190Updated 3 weeks ago
- PowerForensics provides an all in one platform for live disk forensic analysis☆1,423Updated 2 years ago
- Malware Configuration And Payload Extraction☆760Updated last year