What is New
- 🔍 Universal EVTX Parser: Dynamic extraction engine that handles any Event ID and provider (Sysmon, Security, Defender, PowerShell, Task Scheduler, WMI, TerminalServices) without hardcoded schemas. Automatically flattens EventData and UserData blocks and normalizes field names across providers.
- 🌳 Process Tree Reconstruction: Three-pass correlation engine builds full parent-child process forests from Sysmon EID 1 and Security EID 4688. Maps network connections (EID 3), file creates (EID 11), DNS queries (EID 22), and Defender alerts to the exact process node via ProcessGuid.
- 🥷 PowerShell Deep Analysis: Specialized parser for EID 4104 ScriptBlock logging with automatic Base64 payload decoding (UTF-16LE and UTF-8). Decoded payloads are attached directly to the event data for downstream detection.
- 📊 Interactive HTML Dashboard: Standalone, portable HTML report using Bootstrap 5, Chart.js, and vis-network. Includes sidebar navigation, severity and MITRE ATT&CK doughnut charts, activity timeline bar chart, interactive process tree graph (red nodes for suspicious processes), force-directed network correlation graph, sortable findings table, and IOC copy-to-clipboard pills.
- 🛡️ Detection Engine: Modular detection pipeline with four independent scanners: local IOC matching against flat files (O(1) lookups), lightweight Sigma YAML rule evaluator with wildcard support, LOLBin and suspicious command-line detector (certutil, powershell -enc), and decoded Base64 payload alerting.
- 🦠 VirusTotal v3 Integration: Optional online enrichment via --vt-api-key. Includes local JSON file caching (.vt_cache.json) to avoid duplicate API calls, strict 15-second rate limiting for the free tier (4 req/min), and graceful error handling for HTTP 429, timeouts, and network failures. Zero log data is uploaded.
- 🔒 Whitelist Noise Reduction: Regex-based whitelist (config/whitelist.yaml) prunes known-good process branches. A whitelisted process is removed only if it has no suspicious children, network connections, or Defender alerts — preserving forensic context.
- 🥇 MITRE ATT&CK Mappings: All findings automatically include mapped MITRE ATT&CK tactics displayed in the terminal findings table, HTML dashboard, and Markdown report.
- 📄 Multi-Format Export: Generate HTML, JSON, CSV, and Markdown reports in a single run via --format html,json,csv,markdown. The Markdown report follows the PRD outline with executive summary, findings table, Defender alerts, process tree snippets, and IOC listings.
- 🖨️ PDF Export: One-click browser export from the HTML dashboard via html2pdf.js with print-optimized CSS that hides the sidebar and fits charts on A4 pages.
Setup
bash
git clone https://github.com/1tsprune/EVTXCase.git
cd EVTXCase
python -m venv .venv
source .venv/bin/activate
pip install -e .
evtxcase analyze logs/ --output cases/incident-001 --format html,json,csv,markdown