Plugins
1 pluginResults for “windows”
31 skills
mukul975 analyzing-windows-prefetch-with-python
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
24.6k · bundle
mukul975 analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
24.6k · bundle
mukul975 analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
24.6k · bundle
mukul975 extracting-windows-event-logs-artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
24.6k · bundle
mukul975 performing-windows-artifact-analysis-with-eric-zimmerman-too
Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.
24.6k · bundle
mukul975 analyzing-windows-shellbag-artifacts
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
24.6k · bundle
More results
mukul975 generating-forensic-timelines-with-hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
mukul975 detecting-lateral-movement-with-splunk
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
24.6k · bundle
mukul975 parsing-artifacts-with-eric-zimmerman-tools
Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.
24.6k · bundle
mukul975 extracting-memory-artifacts-with-rekall
Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.
24.6k · bundle
mukul975 detecting-living-off-the-land-attacks
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks by monitoring process creation, command-line arguments, and parent-child relationships.
24.6k · bundle
mukul975 performing-memory-forensics-with-volatility3-plugins
Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.
24.6k · bundle
mukul975 analyzing-usb-device-connection-history
Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.
24.6k · bundle
mukul975 implementing-siem-correlation-rules-for-apt
Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.
24.6k · bundle
mukul975 performing-static-malware-analysis-with-pe-studio
Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, resources, and indicators without executing the binary.
24.6k · bundle
mukul975 detecting-pass-the-ticket-attacks
Detect Kerberos Pass-the-Ticket attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM.
24.6k · bundle
mukul975 hunting-for-unusual-service-installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.
24.6k · bundle
tools-only 209-sql-23f1987a
Provides SQL window function examples for ranking, aggregation, lag/lead, value extraction, frame specifications, and advanced analytics.
7 · bundle
mukul975 analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.
24.6k · bundle
agricidaniel ads-attribution
Audit cross-platform attribution by reconciling conversion definitions, reporting windows, and data sources across browsers, servers, MMPs, and ad platforms.
zero-yx kiro-usage-day-report
Generates one-day Kiro credit usage reports from LanceDB usage events, with China-time windows, global totals, and account subset breakdowns.
0 · bundle
jimliu baoyu-electron-extract
Extracts resources and JavaScript from installed Electron apps by unpacking `.asar` bundles, restoring original sources from source maps when available, and formatting minified code with Prettier.
23.1k · bundle
mukul975 hunting-for-defense-evasion-via-timestomping
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT using analyzeMFT and Python.
24.6k · bundle
nvidia cuopt-routing-api-python
Solve vehicle routing problems (TSP, VRP, PDP) using NVIDIA cuOpt's Python API with cost matrices, time windows, capacity constraints, and pickup-delivery pairs.
2.2k · bundle
mukul975 investigating-ransomware-attack-artifacts
Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.
24.6k · bundle
mariadb-corporation mariadb-connector-odbc-install
Installs and configures MariaDB Connector/ODBC, covering driver manager registration, DSN setup, connection-string keywords, and TLS options for Linux, macOS, and Windows.
0
lucaspmarie-a11y graphify-windows
Turns any folder of files into a navigable knowledge graph with community detection, producing interactive HTML, GraphRAG-ready JSON, and a plain-language report.
5 · bundle
mukul975 performing-memory-forensics-with-volatility3
Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.
24.6k · bundle
phoroth graphify-windows
Builds a navigable knowledge graph from any folder of files, with community detection, an audit trail, and outputs including interactive HTML, GraphRAG-ready JSON, and a plain-language report.
3 · bundle
mukul975 analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
mukul975 detecting-golden-ticket-attacks-in-kerberos-logs
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
24.6k · bundle