evtx

EVTX Ein plattformübergreifender Parser für das Windows XML EventLog-Format Funktionen 🔒 Implementiert mit 100 % sicherem Rust – und läuft auf allen von Rust unterstützten Plattformen die eine stdlib haben. ⚡ Schnell – siehe Benchmarks unten. Um Größenordnungen schneller als jede andere...

Zircolite

Eigenständiges SIGMA-basiertes Erkennungstool für EVTX-, Auditd-, Sysmon-für-Linux-, XML-, CSV- oder JSONL/NDJSON-Logs Zircolite ist ein eigenständiges, in Python 3 geschriebenes Tool, mit dem Sie SIGMA-Regeln auf Folgendes anwenden können: MS-Windows-EVTX EVTX-, XML- und JSONL-Formate Auditd-Log...

DeepBlueCLI

DeepBlueCLI DeepBlueCLI – ein PowerShell-Modul zur Bedrohungsjagd mithilfe von Windows-Ereignisprotokollen Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Beispiel-EVTX-Dateien befinden sich im Verzeichnis .\evtx Hinweis Sollte I...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

winevt_logs_analysis

Winevt logs analysis Remote connections Simple script for the purpose of finding remote connections to Windows machine and ideally some public IPs. It checks for some EventIDs regarding remote logins and sessions. You should pip install -r requirements.txt so the script can work and parse some of...

epagneul

epagneul Epagneul è uno strumento per visualizzare e investigare i log degli eventi di Windows. Deploy Richiede che docker e docker-compose siano installati. Installazione root@kitploit: make Deploy offline Su una macchina connessa a internet, costruisci una release offline: root@kitploit: make...

Grafiki

Grafiki Grafiki هو مشروع Django يتعلق بـ Sysmon والرسوم البيانية، في الوقت الحالي. في رأيي، EventViewer و Elastic وحتى Kibana ليست رسومية بما يكفي. التهديدات الحالية معقدة، وإذا كان المهاجمون يفكرون في الرسوم البيانية، فيجب على المدافعين أيضًا فعل ذلك. هذا دليل على المفهوم، لم يتم تصحيح الكود بعد...

CVE-2020-1472-visualizer

CVE-2020-1477 Event Reader v1.1 27/08/2020 Este script irá: 1. Digitalizar os evtx do sistema na pasta de arquivos de entrada para os eventos 5827, 5828, 5829, 5830 e 5831, campos de dados exatos, exportar para 582-.CSV. 2. Chamar o Excel para importar os 582-.CSV resultantes, criar tabelas...

SentinelThread-Forensics

🛡️ Sentinel Thread Pro Die Hochgeschwindigkeits-Windows-Forensik-Triage-Plattform 📋 Die Mission Im modernen SOC-Betrieb ist die manuelle EVTX-Analyse ein Todesurteil für deine MTTR Mean Time to Respond. Sentinel Thread Pro wurde entwickelt, um die Lücke zwischen massiven Roh-Ereignisprotokollen un...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

evtx-baseline

evtx-baseline Un repository che ospita esempi di log evtx goodware con installazioni di software campione e interazioni utente di base Donazioni win10-client.tgz di @phantinuss win11-client.tgz di @frack113 win7-x86.tgz di @pH-T win2022-evtx.tgz di @Neo23x0 win2022-ad.tgz di @frack113...

LogHound

LogHound Analizzatore EVTX Post-Sfruttamento per la Mappatura di BloodHound LogHound raccoglie e analizza i registri eventi di sicurezza di Windows .evtx per estrarre eventi di autenticazione, dati delle sessioni e metadati di accesso, da inserire in BloodHound e per una telemetria avversaria più...

dfir-toolkit

!CAUTION DFIR Toolkit verlässt github Warum? Wir glauben, dass alle Männer und Frauen, und alle Menschen dazwischen und darüber gleich geschaffen sind. In dieser Denkweise ergibt es keinen Sinn, Menschen aufgrund ihres Geburtsortes, ihrer Sprache, Hautfarbe, Religion oder was auch immer zu...

CVE-2026-7572

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

SUSE CVE-2026-7572

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error in the ConsumeUnit16Array and ConsumeUnit64Array functions. An attacker can cause a process crash by supplying a specially crafted .evtx file to the parseevtx VQL plugin on Windows and Linux systems. Remediation A fix w...

GHSA-6CMP-QV2F-X97X Velocidex Velociraptor has an off-by-one error

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

Velocidex Velociraptor has an off-by-one error

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

CVE-2026-7572

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...

CVE-2026-7572 Velociraptor EVTX Parser — Process Crash via Crafted .evtx File

An off-by-one error CWE-193 in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service DoS via a process crash by providing a specially crafted .evtx file to the parseevtx VQL...