Plugins
1 pluginResults for “event-log”
17 skills
mukul975 extracting-windows-event-logs-artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
24.6k · bundle
mukul975 hunting-for-unusual-service-installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.
24.6k · bundle
mukul975 analyzing-usb-device-connection-history
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
24.6k · bundle
mukul975 analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
mukul975 detecting-golden-ticket-attacks-in-kerberos-logs
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
24.6k · bundle
mukul975 performing-linux-log-forensics-investigation
Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.
24.6k · bundle
More results
mukul975 performing-timeline-reconstruction-with-plaso
Build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across file systems, logs, and artifacts into a unified chronological view.
24.6k · bundle
mukul975 implementing-siem-correlation-rules-for-apt
Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.
24.6k · bundle
google data-manager-api-event-ingestion
Upload offline conversions, enhanced conversions for leads, click conversions, and Google Analytics events using the Data Manager API /v1/events/ingest endpoint.
14.4k
mukul975 generating-forensic-timelines-with-hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
x402agent session-logs
Search and analyze conversation history stored in session JSONL files using jq and shell commands.
9
mukul975 investigating-ransomware-attack-artifacts
Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
24.6k · bundle
mukul975 parsing-artifacts-with-eric-zimmerman-tools
Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.
24.6k · bundle
mukul975 building-incident-timeline-with-timesketch
Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.
24.6k · bundle
mariadb-corporation mariadb-binlog
Decodes and replays MariaDB binary logs with correct flags: commented pseudo-SQL vs. executable BINLOG blobs, ANNOTATE_ROWS events, flashback undo SQL, and safe replay via the mariadb client.
0
mukul975 performing-windows-artifact-analysis-with-eric-zimmerman-too
Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.
24.6k · bundle
mukul975 analyzing-cloud-storage-access-patterns
Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls, and potential data exfiltration using statistical baselines.
24.6k · bundle