Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

GhostTask

Ghost Scheduled Task Inspired by WithSecure's research on Scheduled Task Tampering, they explained the feasibility of creating a scheduled task solely through registry key manipulation. Such an approach can bypass the generation of scheduled task creation event logs, such as 4698 and 106, providi...

SharpEventPersist

SharpEventPersist Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to...

EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin es una vulnerabilidad de tiempo de verificación a tiempo de uso en el protocolo MS-EVEN. La vulnerabilidad permite a usuarios con bajos privilegios escribir archivos arbitrarios en una máquina remota, evitando efectivamente la necesidad de una cuenta de...

ZeroLogon-Exploitation-Check

Script to automate Checks for potential exploitation of CVE-2020-1472 aka ZeroLogon in the domain. This is a very "quick and dirty" script that automates some of the leading artifects in determining an actual exploitation of CVE-2020-1472, compiled from multiple blogs. Ideally, the 2nd check for...

EvtMute

EvtMute This is a tool that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging. Usage Grap the latest verison from here. EvtMuteHook.dll contains the core functionality, once it is injected it will apply a temporary filter which will allow a...

hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

LogonTracer

Concept LogonTracer v2 is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a host name or an IP address and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which...

WELA

WELA Windows Event Log Analyzer ゑ羅 A tool for auditing Windows event log settings. Created by Yamato Security — make sure you are actually recording the events that matter for DFIR. 📖 Read the Documentation → Available in 15 languages — English · 日本語 · 繁體中文 · 한국어 · Deutsch · Türkçe · Français ·...

z9

z9 PowerShell Log Analyzer Japanese Abstract This tools detects the artifact of the PowerShell based malware from the eventlog of PowerShell logging. Online Demo Install git clone https://github.com/Sh1n0g1/z9 cd z9 pip install -r requirements.txt How to use usage: z9.py -h --output OUTPUT -s...

RsWindowsThingies

RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: -d, --deb...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

DCSYNCMonitor

DCSYNCMonitor Description This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition...

VindicateTool

Vindicate -brightgreen An LLMNR/NBNS/mDNS Spoofing Detection Toolkit for network administrators What is Vindicate? Vindicate is a tool which detects name service spoofing, often used by IT network attackers to steal credentials e.g. Windows Active Directory passwords from users. It's designed to...

Evtx_Log_Browser

Evtx Log xml Browser Browse through Windows evtx event logs & export to xml Latest version ishere Dependencies: .NET Framework 4.8 Powershell Version: 5.1...

EnableWindowsLogSettings

Yamato Security's Windows Event Log Configuration Guide For DFIR And Threat Hunting English | 日本語 This is yet another guide on properly configuring and monitoring Windows event logs with an emphasis on logging for sigma rules. This is a work in progress, so check back please periodically for...

PrintNightmare

TryHackMe | PrintNightmare PrintNightmare Learn about the vulnerability known as PrintNightmare CVE-2021-1675 and CVE-2021-34527 Task 6 Detection: Windows Event Logs Event Viewer Applications and Services Logs Microsoft Windows PrintService Admin...

Phant0m

Phant0m | Windows Event Log Killer Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this...

RDP-Guard

RDP Guard RDP Guard monitors failed RDP sign-in attempts in the Windows Security log and blocks abusive remote IP addresses through Windows Firewall. Defaults Event ID: 4625 LogonType: 3 or 10 Threshold: 3 or more audit failures Check interval: 15 minutes Firewall rule name:...