Windows Events Attack Samples
-
Updated
Jan 24, 2023 - HTML
#
evtx
Here are 90 public repositories matching this topic...
Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...
-
Updated
Nov 8, 2025
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
detection logs python3 forensics dfir sysmon auditd sigma evtx sigma-rules dfir-automation forensics-tools pysigma dfir-tools evtxtract
-
Updated
Aug 24, 2026 - Python
Windows Event Log tooling for PowerShell and .NET: typed queries, reporting, export, WEC, automation, and the PSEventViewer module.
windows monitoring csharp dotnet powershell reporting activedirectory event-log powershell-module wec evtx windows-event-log
-
Updated
Sep 11, 2026 - C#
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
-
Updated
May 21, 2026
Free, open-source CMTrace replacement for Windows log files: ConfigMgr/SCCM, Intune IME, and Autopilot ESP diagnostics, DSRegCmd triage, .evtx viewing, real-time tailing, and Windows error-code lookup. Windows, macOS, Linux.
windows rust log-viewer sysadmin sccm configmgr mdm troubleshooting intune microsoft-intune tauri evtx cmtrace mecm dsregcmd windows-autopilot endpoint-management entra-id event-log-viewer enrollment-status-page
-
Updated
Sep 12, 2026 - Rust
Graph Visualization for windows event logs
security forensics threat-hunting hunting blueteam security-tools evtx dfir-automation forensics-tools
-
Updated
Jan 15, 2025 - Python
evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
-
Updated
Nov 30, 2021 - Python
Parse evtx files and detect use of the DanderSpritz eventlogedit module
-
Updated
Dec 15, 2017 - Python
ThreatSeeker: Threat Hunting via Windows Event Logs
-
Updated
May 16, 2023 - Python
Load Windows Event Log (.evtx) files into Elasticsearch, or export them as JSON lines. Born on an offline threat hunt; rebuilt for Elasticsearch 9.
python elasticsearch log-analysis incident-response forensics dfir threat-hunting security-tools blue-team evtx windows-event-log
-
Updated
Sep 5, 2026 - Python
A command-line tool for parsing Windows Event Logs and importing the results into Elasticsearch.
-
Updated
Jun 2, 2026 - Python
Active Directory Forensic Toolkit : Detect & reconstruct AD attacks from Windows event logs (EVTX)
python incident-response active-directory forensics dfir threat-hunting siem blue-team evtx windows-security
-
Updated
Aug 29, 2026 - Python
Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.
windows analytics analysis dotnet powershell detection logging logs cybersecurity sysmon siem hunting forwarder defense eventlog log-forwarder evtx logging-framework logging-agent windowsevents
-
Updated
May 13, 2026 - C#
Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.
rust neo4j vss incident-response dfir graph-database event-log threat-hunting digital-forensics cypher ual evtx kape lateral-movement velociraptor memgraph digital-forensics-incident-response windows-forensics digital-forensic-tool forensic-tool
-
Updated
May 21, 2026 - Rust
Logpresso Mini and community contents for incident response
-
Updated
Oct 21, 2021
Add this topic to your repo
To associate your repository with the evtx topic, visit your repo's landing page and select "manage topics."