106 Commits

Author SHA1 Message Date
Matt Hastings d2e30e0e45 Deleting providers.md 2017-09-23 17:27:05 -04:00
Matt Hastings b14d5a0982 Adding graph function 2017-09-23 08:23:55 -04:00
Matt Hastings 15ce3b89cf other minor demo tweaks 2017-09-22 12:38:28 -04:00
Matt Hastings 9e3a816502 Demo tweaks 2017-09-22 12:07:00 -04:00
Matt Hastings 277dfc53de Demo updates 2017-09-21 13:28:05 -04:00
Matt Hastings c940e1eaa5 Updating demo materials 2017-09-20 08:35:47 -04:00
Dave Hull c63df6f649 Adds compressed etl files 2017-09-19 08:09:32 -05:00
Matt Hastings 86f5df6462 Adding powershell logging 2017-09-16 10:03:24 -04:00
Matt Hastings a91a9646f9 Demo all the things 2017-09-15 09:04:15 -04:00
Matt Hastings f7bf024913 More demo updates 2017-09-15 08:55:05 -04:00
Matt Hastings 22f3463767 Minor tweaks to demo.txt 2017-09-15 07:53:05 -04:00
Matt Hastings d7a943dd9e Adding new demo.xml 2017-09-15 07:49:25 -04:00
Matt Hastings 16b9485683 Updating demo.txt 2017-09-15 07:47:22 -04:00
Matt Hastings 1721e11842 Fixing small thread parsing bug 2017-09-15 07:42:46 -04:00
Dave Hull 3fc7c90eb5 Adds dcdemo files 2017-09-14 15:59:25 -05:00
Matt Hastings 1a9d2204e4 Last readme updates for the night 2017-09-11 21:12:53 -04:00
Matt Hastings 5ab7930296 Readme changes 2017-09-11 20:55:32 -04:00
Matt Hastings 844751d7cf More Readme updates 2017-09-11 20:51:18 -04:00
Matt Hastings 6758069e63 Updating readme 2017-09-11 20:49:28 -04:00
Matt Hastings 8099446971 Adding demo content 2017-09-07 22:02:54 -04:00
Matt Hastings a0fe1d2b1d Final rename commit 2017-09-04 21:33:00 -04:00
Matt Hastings 227b8adafa Adding files for rename 2017-09-04 21:05:09 -04:00
Matt Hastings 96c77bde6b Renaming module 2017-09-04 21:04:35 -04:00
Matt Hastings 99c97f5f73 Adding more example in the readme 2017-08-24 08:09:53 -04:00
Matt Hastings d0df4073ad fixing a bunch of bugs 2017-08-23 15:46:24 -04:00
Matt Hastings 94fa674a06 Adding support for different logging levels 2017-08-18 09:44:40 -04:00
Matt Hastings 96d962b1bc Add new write-log function for console logging 2017-08-18 09:34:42 -04:00
Matt Hastings 6d48ae28c6 Fixing path and infinite loop bugs 2017-08-18 08:41:44 -04:00
Matt Hastings ecd8d4119b Updating readme 2017-08-15 15:26:02 -04:00
Matt Hastings 603246d388 Updating kernel session parsing code 2017-08-15 11:23:24 -04:00
Matt Hastings 3b4be2a7d6 Add in kernel session support to capture command line 2017-08-14 17:53:19 -04:00
Matt Hastings e18f3f0620 small change to readme 2017-08-11 10:39:19 -04:00
Matt Hastings d42f0afd94 Updating readme 2017-08-11 10:32:33 -04:00
Matt Hastings 563a4f9179 fixing minor bug in thread net connections 2017-08-10 21:54:55 -04:00
Matt Hastings 8c74ab9e74 Fixing bug in DNS tracking 2017-08-08 10:27:48 -04:00
Matt Hastings 0dd110e39c Major reword to support thread tracking 2017-08-08 08:58:01 -04:00
Matt Hastings 4e219109cf Add in thread keyword to forensic collection func 2017-08-07 09:24:19 -04:00
Matt Hastings 2b31524c73 Adding in thread start/stop events 2017-08-07 09:13:59 -04:00
Matt Hastings d4cb3dd2af Add in EnableVerbosity option to etwforensic func 2017-08-06 12:43:57 -04:00
Matt Hastings ae33ecb452 Removing debug strings 2017-08-06 12:38:07 -04:00
Matt Hastings 50d3bbb8c1 Fixing bug in filtering and dns 2017-08-06 12:03:19 -04:00
Matt Hastings adc491146f Updating DNS parsing 2017-08-06 11:14:53 -04:00
Matt Hastings d189c1b38e Adding DNS to etwforensic collection and log parsing 2017-08-04 09:23:56 -04:00
Matt Hastings 9175dbe50a Fixing image load bug with process end time 2017-07-31 23:49:42 -04:00
Dave Hull cfce24d15c Adds DNS to Start-ETWForensicCollection 2017-07-18 13:02:20 -05:00
Matt Hastings e9450b5a73 Adding DLLs for kernel session 2017-07-03 08:33:21 -04:00
Matt Hastings cd01839e54 Fix bug in process reuse code 2017-06-27 20:39:57 -04:00
Matt Hastings 5fda42f34e Add logic for process reuse 2017-06-27 20:32:12 -04:00
Matt Hastings 6ec4d7883c Fixing bug in process id parsing 2017-06-27 18:51:28 -04:00
Matt Hastings 56baf47e39 Adding in file event parser 2017-06-26 00:06:36 -04:00