evtx-analysis

This is a PySimpleGUI-based Python software tool for processing and visualising selected Windows Event Security.evtx log files that meet a condition in Event ID 4688.

A simple System monitor(Sysmon) EVTX inspector; search, visualize, and track Sysmon events

Advanced PowerShell DFIR module for forensic analysis, threat hunting, and cmdline investigation in Windows.

A python 3 script to extract and re-create Powershell script block from windows event logs(evtx).

Covert folder containing windows event logs (*.evtx) to sorted timeline csv files for easy processing and analysis.

Lightweight Python engine for parsing Windows EVTX logs and detecting suspicious process creation (ID 1) and PowerShell activity (ID 4104).

Windows Persistence & Lateral Movement Detection, Log Analysis Challenge

Windows 安全排查轻量工具，集成 Sysmon 管理、事件监控、攻击链分析与取证快照

A modular Windows Event Log (EVTX) forensic analysis platform built with Python and PyQt6, featuring security detection, IOC extraction, event correlation, anomaly detection, MITRE ATT&CK mapping, risk scoring, investigation graphs, and forensic reporting.

AI-assisted SOC analysis pipeline with deterministic guardrails, evidence-first reporting, and multi-source security log ingestion.