Windows Event Logs

ChainsawRust

A fast, standalone tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts.

HayabusaRust

A Sigma-based threat hunting and fast forensics timeline generator for Windows event logs, written in Rust.

DeepBlueCLIPowerShell

A PowerShell module for threat hunting and detecting malicious activity via Windows Event Logs.

APT HunterPython

A threat hunting tool that analyzes Windows event logs to detect APT movements and suspicious activity using pre-defined rules and statistical analysis.

Awesome Event IDs

A curated collection of Event ID resources for digital forensics and incident response professionals.

EVTXtractPython

Recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.