Alternatives and similar repositories for python-registry:

Users that are interested in python-registry are comparing it to the libraries listed below

• mandiant / flare-wmi
  ☆429Updated last year
• mandiant / ShimCacheParser
  ☆276Updated 2 years ago
• volatilityfoundation / community
  Volatility plugins developed and maintained by the community
  ☆359Updated 4 years ago
• mkorman90 / regipy
  Regipy is an os independent python library for parsing offline registry hives
  ☆255Updated last week
• williballenthin / INDXParse
  Tool suite for inspecting NTFS artifacts.
  ☆221Updated last year
• rowingdude / analyzeMFT
  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…
  ☆474Updated 6 months ago
• R3MRUM / PSDecode
  PowerShell script for deobfuscating encoded PowerShell scripts
  ☆425Updated 4 years ago
• fireeye / pywintrace
  ETW Python Library
  ☆281Updated last year
• decalage2 / ViperMonkey
  A VBA parser and emulation engine to analyze malicious macros.
  ☆1,086Updated 9 months ago
• williballenthin / EVTXtract
  EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
  ☆192Updated last month
• SekoiaLab / Fastir_Collector
  ☆507Updated 4 years ago
• hatching / vmcloak
  Automated Virtual Machine Generation and Cloaking for Cuckoo Sandbox.
  ☆497Updated 11 months ago
• davidpany / WMI_Forensics
  ☆302Updated 4 years ago
• jschicht / RawCopy
  Commandline low level file extractor for NTFS
  ☆285Updated 5 years ago
• gleeda / memtriage
  Allows you to quickly query a Windows machine for RAM artifacts
  ☆221Updated 4 years ago
• airbus-cert / regrippy
  A modern Python-3-based alternative to RegRipper
  ☆194Updated 3 weeks ago
• msuhanov / dfir_ntfs
  An NTFS/FAT parser for digital forensics & incident response
  ☆203Updated 5 months ago
• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆735Updated last year
• godaddy / procfilter
  A YARA-integrated process denial framework for Windows
  ☆398Updated 5 years ago
• CERT-Polska / mquery
  YARA malware query accelerator (web frontend)
  ☆426Updated last month
• MalwareCantFly / Vba2Graph
  Vba2Graph - Generate call graphs from VBA code, for easier analysis of malicious documents.
  ☆278Updated 3 years ago
• halpomeranz / lmg
  Script for automating Linux memory capture and analysis
  ☆269Updated 5 years ago
• kevthehermit / VolUtility
  Web App for Volatility framework
  ☆380Updated 5 months ago
• bontchev / pcodedmp
  A VBA p-code disassembler
  ☆467Updated 3 years ago
• williballenthin / python-sdb
  Pure Python parser for Application Compatibility Shim Databases (.sdb files)
  ☆109Updated 4 years ago
• jschicht / LogFileParser
  Parser for $LogFile on NTFS
  ☆193Updated last year
• williballenthin / python-evtx
  Pure Python parser for Windows Event Log files (.evtx)
  ☆738Updated 8 months ago
• msuhanov / yarp
  Yet another registry parser
  ☆132Updated 3 years ago
• ctxis / CAPE
  Malware Configuration And Payload Extraction
  ☆754Updated 5 months ago
• dod-cyber-crime-center / DC3-MWCP
  DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted …
  ☆313Updated 2 months ago