Results for “evtx”
11 skills
mukul975 Extracting Windows Event Logs Artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
24.6k · bundle
mukul975 Analyzing Powershell Script Block Logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
mukul975 Generating Forensic Timelines With Hayabusa
Generate Sigma-based forensic timelines from Windows EVTX files using Hayabusa for incident response triage.
24.6k · bundle
mukul975 Hunting Evtx With Chainsaw
Hunt for threats in Windows Event Logs using Chainsaw, a fast Rust-based forensic tool that runs Sigma rules, keyword searches, and artifact analysis offline.
24.6k · bundle
mukul975 Detecting Rdp Brute Force Attacks
Analyze Windows Security Event Logs to detect RDP brute force attacks by parsing Event ID 4625 and 4624 entries, identifying source IP frequency, and generating detection reports.
24.6k · bundle
More results
mukul975 Hunting For Lateral Movement Via Wmi
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.
24.6k · bundle
mukul975 Hunting For Anomalous Powershell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events from Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles.
24.6k · bundle
mukul975 Performing Log Analysis For Forensic Investigation
Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.
24.6k · bundle
mukul975 Hunting For T1098 Account Manipulation
Detect MITRE ATT&CK T1098 account manipulation techniques including shadow admin creation, SID history injection, group membership changes, and credential modifications using Windows Security Event Logs.
24.6k · bundle
mukul975 Performing Windows Artifact Analysis With Eric Zimmerman Too
Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.
24.6k · bundle
mukul975 Hunting For Unusual Service Installations
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.
24.6k · bundle