williballenthin / python-evtxLinks
Pure Python parser for Windows Event Log files (.evtx)
☆759Updated 6 months ago
Alternatives and similar repositories for python-evtx
Users that are interested in python-evtx are comparing it to the libraries listed below
Sorting:
- analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…☆511Updated 4 months ago
- Pure Python parser for Windows Registry hives.☆439Updated 10 months ago
- Volatility plugins developed and maintained by the community☆374Updated 4 years ago
- Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into …☆815Updated 2 years ago
- PowerShell Obfuscation Detection Framework☆748Updated 2 years ago
- RDP Bitmap Cache parser☆620Updated 11 months ago
- A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.☆732Updated 6 months ago
- A VBA parser and emulation engine to analyze malicious macros.☆1,113Updated last year
- A Powershell incident response framework☆1,633Updated 3 years ago
- PowerShell script for deobfuscating encoded PowerShell scripts☆428Updated 4 years ago
- ☆1,091Updated 6 years ago
- ☆427Updated 2 years ago
- ☆519Updated 4 years ago
- Investigate suspicious activity by visualizing Sysmon's event log☆427Updated 2 years ago
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆932Updated 2 years ago
- Indicators from Unit 42 Public Reports☆728Updated 4 months ago
- Utilities for Sysmon☆1,564Updated 3 months ago
- yarGen is a generator for YARA rules☆1,753Updated 2 months ago
- Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsac…☆882Updated 5 years ago
- ☆810Updated 2 years ago
- Noriben - Portable, Simple, Malware Analysis Sandbox☆1,209Updated 4 months ago
- Yara Rule Analyzer and Statistics☆396Updated 2 years ago
- ☆306Updated 5 years ago
- ☆280Updated 2 years ago
- PowerForensics provides an all in one platform for live disk forensic analysis☆1,421Updated 2 years ago
- Tool Analysis Result Sheet☆356Updated 8 years ago
- Regipy is an os independent python library for parsing offline registry hives☆265Updated 2 weeks ago
- Volatility plugin for extracts configuration data of known malware☆493Updated 2 years ago
- RegRipper3.0☆668Updated last year
- A set of Zeek scripts to detect ATT&CK techniques.☆620Updated last year