├── .gitignore ├── LICENSE ├── app ├── evtx_hunter.py ├── graphing │ ├── histogram.py │ ├── sankey.py │ └── table.py ├── helpers │ ├── evtx_loader.py │ └── utils.py └── vars.py ├── documentation └── screenshots │ ├── first_time_example.PNG │ └── report_header.PNG ├── external ├── event_id_mapping.csv └── evtx_dump-v0.7.2.exe ├── readme.md ├── requirements.txt ├── rules ├── first_occurence.json └── interesting_events.json └── stylesheets └── style.css /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/.gitignore -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/LICENSE -------------------------------------------------------------------------------- /app/evtx_hunter.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/evtx_hunter.py -------------------------------------------------------------------------------- /app/graphing/histogram.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/graphing/histogram.py -------------------------------------------------------------------------------- /app/graphing/sankey.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/graphing/sankey.py -------------------------------------------------------------------------------- /app/graphing/table.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/graphing/table.py -------------------------------------------------------------------------------- /app/helpers/evtx_loader.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/helpers/evtx_loader.py -------------------------------------------------------------------------------- /app/helpers/utils.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/helpers/utils.py -------------------------------------------------------------------------------- /app/vars.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/app/vars.py -------------------------------------------------------------------------------- /documentation/screenshots/first_time_example.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/documentation/screenshots/first_time_example.PNG -------------------------------------------------------------------------------- /documentation/screenshots/report_header.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/documentation/screenshots/report_header.PNG -------------------------------------------------------------------------------- /external/event_id_mapping.csv: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/external/event_id_mapping.csv -------------------------------------------------------------------------------- /external/evtx_dump-v0.7.2.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/external/evtx_dump-v0.7.2.exe -------------------------------------------------------------------------------- /readme.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/readme.md -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/requirements.txt -------------------------------------------------------------------------------- /rules/first_occurence.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/rules/first_occurence.json -------------------------------------------------------------------------------- /rules/interesting_events.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/rules/interesting_events.json -------------------------------------------------------------------------------- /stylesheets/style.css: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/NVISOsecurity/evtx-hunter/HEAD/stylesheets/style.css --------------------------------------------------------------------------------