Plugins

1 plugin

Windows Forensics Toolkit

For digital forensics analysts investigating Windows systems using registry artifacts, prefetch, and event logs.

6 skills · plugin

Results for “windows-event-logs”

9 skills

Extracting Windows Event Logs Artifacts

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

24.6k · bundle

Hunting For Unusual Service Installations

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

24.6k · bundle

Generating Forensic Timelines With Hayabusa

Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.

24.6k · bundle

More results

Performing Windows Artifact Analysis With Eric Zimmerman Too

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

24.6k · bundle

Performing Linux Log Forensics Investigation

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

24.6k · bundle

Analyzing Powershell Script Block Logging

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.

24.6k · bundle

Parsing Artifacts With Eric Zimmerman Tools

Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.

24.6k · bundle

Performing Cloud Log Forensics With Athena

Query AWS CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena for forensic investigation of security incidents.

24.6k · bundle

Detecting Golden Ticket Attacks In Kerberos Logs

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.

24.6k · bundle