Matt Hastings
|
d2e30e0e45
|
Deleting providers.md
|
2017-09-23 17:27:05 -04:00 |
|
Matt Hastings
|
b14d5a0982
|
Adding graph function
|
2017-09-23 08:23:55 -04:00 |
|
Matt Hastings
|
15ce3b89cf
|
other minor demo tweaks
|
2017-09-22 12:38:28 -04:00 |
|
Matt Hastings
|
9e3a816502
|
Demo tweaks
|
2017-09-22 12:07:00 -04:00 |
|
Matt Hastings
|
277dfc53de
|
Demo updates
|
2017-09-21 13:28:05 -04:00 |
|
Matt Hastings
|
c940e1eaa5
|
Updating demo materials
|
2017-09-20 08:35:47 -04:00 |
|
Dave Hull
|
c63df6f649
|
Adds compressed etl files
|
2017-09-19 08:09:32 -05:00 |
|
Matt Hastings
|
86f5df6462
|
Adding powershell logging
|
2017-09-16 10:03:24 -04:00 |
|
Matt Hastings
|
a91a9646f9
|
Demo all the things
|
2017-09-15 09:04:15 -04:00 |
|
Matt Hastings
|
f7bf024913
|
More demo updates
|
2017-09-15 08:55:05 -04:00 |
|
Matt Hastings
|
22f3463767
|
Minor tweaks to demo.txt
|
2017-09-15 07:53:05 -04:00 |
|
Matt Hastings
|
d7a943dd9e
|
Adding new demo.xml
|
2017-09-15 07:49:25 -04:00 |
|
Matt Hastings
|
16b9485683
|
Updating demo.txt
|
2017-09-15 07:47:22 -04:00 |
|
Matt Hastings
|
1721e11842
|
Fixing small thread parsing bug
|
2017-09-15 07:42:46 -04:00 |
|
Dave Hull
|
3fc7c90eb5
|
Adds dcdemo files
|
2017-09-14 15:59:25 -05:00 |
|
Matt Hastings
|
1a9d2204e4
|
Last readme updates for the night
|
2017-09-11 21:12:53 -04:00 |
|
Matt Hastings
|
5ab7930296
|
Readme changes
|
2017-09-11 20:55:32 -04:00 |
|
Matt Hastings
|
844751d7cf
|
More Readme updates
|
2017-09-11 20:51:18 -04:00 |
|
Matt Hastings
|
6758069e63
|
Updating readme
|
2017-09-11 20:49:28 -04:00 |
|
Matt Hastings
|
8099446971
|
Adding demo content
|
2017-09-07 22:02:54 -04:00 |
|
Matt Hastings
|
a0fe1d2b1d
|
Final rename commit
|
2017-09-04 21:33:00 -04:00 |
|
Matt Hastings
|
227b8adafa
|
Adding files for rename
|
2017-09-04 21:05:09 -04:00 |
|
Matt Hastings
|
96c77bde6b
|
Renaming module
|
2017-09-04 21:04:35 -04:00 |
|
Matt Hastings
|
99c97f5f73
|
Adding more example in the readme
|
2017-08-24 08:09:53 -04:00 |
|
Matt Hastings
|
d0df4073ad
|
fixing a bunch of bugs
|
2017-08-23 15:46:24 -04:00 |
|
Matt Hastings
|
94fa674a06
|
Adding support for different logging levels
|
2017-08-18 09:44:40 -04:00 |
|
Matt Hastings
|
96d962b1bc
|
Add new write-log function for console logging
|
2017-08-18 09:34:42 -04:00 |
|
Matt Hastings
|
6d48ae28c6
|
Fixing path and infinite loop bugs
|
2017-08-18 08:41:44 -04:00 |
|
Matt Hastings
|
ecd8d4119b
|
Updating readme
|
2017-08-15 15:26:02 -04:00 |
|
Matt Hastings
|
603246d388
|
Updating kernel session parsing code
|
2017-08-15 11:23:24 -04:00 |
|
Matt Hastings
|
3b4be2a7d6
|
Add in kernel session support to capture command line
|
2017-08-14 17:53:19 -04:00 |
|
Matt Hastings
|
e18f3f0620
|
small change to readme
|
2017-08-11 10:39:19 -04:00 |
|
Matt Hastings
|
d42f0afd94
|
Updating readme
|
2017-08-11 10:32:33 -04:00 |
|
Matt Hastings
|
563a4f9179
|
fixing minor bug in thread net connections
|
2017-08-10 21:54:55 -04:00 |
|
Matt Hastings
|
8c74ab9e74
|
Fixing bug in DNS tracking
|
2017-08-08 10:27:48 -04:00 |
|
Matt Hastings
|
0dd110e39c
|
Major reword to support thread tracking
|
2017-08-08 08:58:01 -04:00 |
|
Matt Hastings
|
4e219109cf
|
Add in thread keyword to forensic collection func
|
2017-08-07 09:24:19 -04:00 |
|
Matt Hastings
|
2b31524c73
|
Adding in thread start/stop events
|
2017-08-07 09:13:59 -04:00 |
|
Matt Hastings
|
d4cb3dd2af
|
Add in EnableVerbosity option to etwforensic func
|
2017-08-06 12:43:57 -04:00 |
|
Matt Hastings
|
ae33ecb452
|
Removing debug strings
|
2017-08-06 12:38:07 -04:00 |
|
Matt Hastings
|
50d3bbb8c1
|
Fixing bug in filtering and dns
|
2017-08-06 12:03:19 -04:00 |
|
Matt Hastings
|
adc491146f
|
Updating DNS parsing
|
2017-08-06 11:14:53 -04:00 |
|
Matt Hastings
|
d189c1b38e
|
Adding DNS to etwforensic collection and log parsing
|
2017-08-04 09:23:56 -04:00 |
|
Matt Hastings
|
9175dbe50a
|
Fixing image load bug with process end time
|
2017-07-31 23:49:42 -04:00 |
|
Dave Hull
|
cfce24d15c
|
Adds DNS to Start-ETWForensicCollection
|
2017-07-18 13:02:20 -05:00 |
|
Matt Hastings
|
e9450b5a73
|
Adding DLLs for kernel session
|
2017-07-03 08:33:21 -04:00 |
|
Matt Hastings
|
cd01839e54
|
Fix bug in process reuse code
|
2017-06-27 20:39:57 -04:00 |
|
Matt Hastings
|
5fda42f34e
|
Add logic for process reuse
|
2017-06-27 20:32:12 -04:00 |
|
Matt Hastings
|
6ec4d7883c
|
Fixing bug in process id parsing
|
2017-06-27 18:51:28 -04:00 |
|
Matt Hastings
|
56baf47e39
|
Adding in file event parser
|
2017-06-26 00:06:36 -04:00 |
|