Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 

README.md

danderspritz-evtx

Parse evtx files and detect use of the DanderSpritz eventlogedit module

Usage

$ ./danderspritz_evtx.py -h
usage: danderspritz_evtx.py [-h] -i INPUT_PATH [-o OUTPUT_PATH]
                            [-e EXPORT_PATH]

danderspritz_evtx.py - Parse evtx files and detect the use of the danderspritz
module that deletes evtx entries

optional arguments:
  -h, --help            show this help message and exit
  -i INPUT_PATH, --input INPUT_PATH
                        Path to evtx file
  -o OUTPUT_PATH, --output OUTPUT_PATH
                        Path to corrected evtx file
  -e EXPORT_PATH, --export EXPORT_PATH
                        Path to location to store exported xml records

Example output

$ ./danderspritz_evtx.py -i Security.evtx -o Security_fixed.evtx -e Security_export.xml
Reading records from Security.evtx...
Found a deleted record within record number 2112 at offset 0x1EA0
Found a deleted record within record number 2112 at offset 0x1CD8
Found a deleted record within record number 2112 at offset 0x1B30
Found a deleted record within record number 2112 at offset 0x1240
Found a deleted record within record number 2112 at offset 0x0618
Found a deleted record within record number 2112 at offset 0x01E8
Found a deleted record within record number 2113 at offset 0x08C0

About

Parse evtx files and detect use of the DanderSpritz eventlogedit module

Topics

Resources

Packages

No packages published

Languages

You can’t perform that action at this time.