Windows Events Attack Samples

• UpdatedJan 24, 2023
• HTML

Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

• UpdatedSep 4, 2024

Pure Python parser for Windows Event Log files (.evtx)

• UpdatedJul 27, 2024
• Python

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• UpdatedFeb 4, 2025
• Python

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

• UpdatedJan 15, 2025

C# based evtx parser with lots of extras

• UpdatedMar 17, 2025
• C#

Graph Visualization for windows event logs

• UpdatedJan 15, 2025
• Python

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

• UpdatedNov 30, 2021
• Python

Parse evtx files and detect use of the DanderSpritz eventlogedit module

• UpdatedDec 15, 2017
• Python

ThreatSeeker: Threat Hunting via Windows Event Logs

• UpdatedMay 16, 2023
• Python

A library for fast parse & import of Windows Eventlogs into Elasticsearch.

• UpdatedJun 28, 2024
• Python

Evtx Log (xml) Browser

• UpdatedMar 12, 2023
• PowerShell

Triaging Windows event logs based on SANS Poster

• UpdatedJan 7, 2023
• PowerShell

Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here athttps://github.com/ceramicskate0/SWELF/releases/latest.

• UpdatedJun 20, 2023
• C#

Logpresso Mini and community contents for incident response

• UpdatedOct 21, 2021

EvtXHunt is an Autopsy plugin that is able to analyze Windows EVTX logs against a library of SIGMA rules.

• UpdatedNov 7, 2021
• Python

Powershell scripts

• UpdatedJul 17, 2022
• PowerShell

Glossy Event Log Forensics

• UpdatedDec 5, 2023
• JavaScript

This is a PySimpleGUI-based Python software tool for processing and visualising selected Windows Event Security.evtx log files that meet a condition in Event ID 4688.

• UpdatedJun 15, 2024
• Python

A simple System monitor(Sysmon) EVTX inspector; search, visualize, and track Sysmon events

• UpdatedJun 11, 2024
• Go