GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → NVISOsecurity → evtx-hunter

NVISOsecurity / evtx-hunter

Licence: GPL-3.0 license
evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

Programming Languages

python
139335 projects - #7 most used programming language
CSS
56736 projects

Labels

incident-responsecsirtinfosecthreat-huntingnetsecevtx

Projects that are alternatives of or similar to evtx-hunter

training-materials
No description or website provided.
Stars: ✭ 47 (-61.48%)
Mutual labels:  incident-response, csirt, infosec
Fame
FAME Automates Malware Evaluation
Stars: ✭ 663 (+443.44%)
Mutual labels:  incident-response, infosec
Fcl
FCL (Fileless Command Lines) - Known command lines of fileless malicious executions
Stars: ✭ 409 (+235.25%)
Mutual labels:  incident-response, threat-hunting
Pockint
A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️
Stars: ✭ 196 (+60.66%)
Mutual labels:  incident-response, infosec
Apt Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
Stars: ✭ 297 (+143.44%)
Mutual labels:  incident-response, threat-hunting
Watcher
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
Stars: ✭ 324 (+165.57%)
Mutual labels:  incident-response, threat-hunting
Beagle
Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
Stars: ✭ 976 (+700%)
Mutual labels:  incident-response, threat-hunting
rhq
Recon Hunt Queries
Stars: ✭ 66 (-45.9%)
Mutual labels:  incident-response, threat-hunting
Threathunt
ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
Stars: ✭ 92 (-24.59%)
Mutual labels:  incident-response, threat-hunting
Patrowldocs
PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform
Stars: ✭ 105 (-13.93%)
Mutual labels:  incident-response, threat-hunting
Mthc
All-in-one bundle of MISP, TheHive and Cortex
Stars: ✭ 134 (+9.84%)
Mutual labels:  incident-response, threat-hunting
Weffles
Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
Stars: ✭ 176 (+44.26%)
Mutual labels:  incident-response, threat-hunting
Threatpinchlookup
Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension
Stars: ✭ 257 (+110.66%)
Mutual labels:  incident-response, threat-hunting
Patrowlmanager
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Stars: ✭ 363 (+197.54%)
Mutual labels:  incident-response, threat-hunting
InfosecHouse
Infosec resource center for offensive and defensive security operations.
Stars: ✭ 61 (-50%)
Mutual labels:  incident-response, infosec
Bashfuscator
A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.
Stars: ✭ 690 (+465.57%)
Mutual labels:  incident-response, infosec
Oriana
Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.
Stars: ✭ 152 (+24.59%)
Mutual labels:  incident-response, threat-hunting
fastfinder
Incident Response - Fast suspicious file finder
Stars: ✭ 116 (-4.92%)
Mutual labels:  incident-response, threat-hunting
YAFRA
YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.
Stars: ✭ 22 (-81.97%)
Mutual labels:  incident-response, threat-hunting
Ioc Explorer
Explore Indicators of Compromise Automatically
Stars: ✭ 73 (-40.16%)
Mutual labels:  incident-response, threat-hunting
View All Similar Projects ➔

Introduction

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

It can process a high number of events quickly, making it suitable for use during investigations and hunting activities across a high number of collected events.

Report header Example of a first time detection

What is evtx-hunter

evtx-hunter is a Python tool that generates a web report of interesting activity observed in EVTX files. The tool comes with a few predefined rules to help you get going. This includes rules to spot for example:

  • The first time a certain DNS domain is queried;
  • The first time a certain process is launched;
  • New service installations;
  • User account lockouts;
  • ...

New use cases can easily be added to support your use case:

  • rules/first_occurence.json: monitor the first time something happens that matches the rule, such as installing a new (malicious) service or using a compromised user account.

  • rules/interesting_events.json: monitor each time something happens that matches the rule, such as clearing the audit log or installing a new service.

Why evtx-hunter?

We developed evtx-hunter to quickly process a large volume of events stored in EVTX dump files during incident response activities. We love tools like Event Log Explorer and Evtx Explorer but found them most suited to deep dive into a specific EVTX file - quickly spotted interesting activity across a large number of EVTX events is something we were missing - this was the reason to develop and release evtx-hunter.

Requirements

evtx-hunter only runs on Windows due to its dependency on EVTX Parsing library, which is included in the tool.

It requires Python (tested in python 3.9 but any version >=python 3.0 will most likely work).

Installation

pip install -r requirements.txt

Usage

python evtx_hunter.py <evtx_folder>

Once the EVTX files have been processed, a link on the command line will be printed to view the generated report in your browser (typically http://127.0.0.1:8050/).

Roadmap

We plan to continuously improve this tool in a few different ways, based on our experience using it during incidents where EVTX files require investigation:

  • Add new rules to spot new interesting activity in EVTX files;
  • Improve how the information is presented in the resulting report;
  • Make the reports interactive (live filtering & searching for example).

Contributions

Everyone is invited to contribute!

If you are a user of the tool and have a suggestion for a new feature or a bug to report, please do so through the issue tracker.

Acknowledgements

Developed by Daan Raman, @NVISO_labs

External libraries

License

evtx-hunter is released under the GNU GENERAL PUBLIC LICENSE v3 (GPL-3). LICENSE

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].