nvisosecurity / evtx-hunter Goto Github PK

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

License: GNU General Public License v3.0

Python 65.71% CSS 34.29%

threat-hunting evtx incident-response infosec netsec csirt

evtx-hunter's Issues

Logon statistics

Provide insight on: total number of failed logons for users, etc.
Could be a separate model too to make it as flexible as possible to monitor any type of activity (number of services installed for example).

lateral movement mapping

List all users being used to connect to remote machines
List incoming connections per machine and user

Issue: No such file or directory

Hello,
Windows 10 issue with Python 3.8.0 :

python evtx_hunter.py c:\Windows\System32\winevt\Logs

2021-11-01 17:18:04,220 - evtx-hunter - INFO - started evtx-hunter
Traceback (most recent call last):
  File "evtx_hunter.py", line 100, in <module>
    main()
  File "evtx_hunter.py", line 36, in main
    evtxloader.load_evtx_files()
  File "evtx-hunter-main\app\helpers\evtx_loader.py", line 63, in load_evtx_files
    with open(vars.TMP_DIR + "files.json", "w") as outfile:
FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Users\\x\\Desktop\\evtx-hunter-main\\app/../tmp/files.json'

Recommend Projects