admin/matthastings-PSalander
1
0
Fork 0
mirror of https://github.com/matthastings/PSalander synced 2026-06-08 15:46:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 1113f6e69a fixing demo for mac master Matthew Hastings 2018-09-16 21:24:13 -04:00
  • a53fea557b Removing old files Matt Hastings 2017-09-23 17:34:58 -04:00
  • d2e30e0e45 Deleting providers.md develop Matt Hastings 2017-09-23 11:32:56 -04:00
  • f0611ac6fe Initial public release 1.0 Matt Hastings 2017-09-23 11:25:44 -04:00
  • b14d5a0982 Adding graph function Matt Hastings 2017-09-23 08:23:55 -04:00
  • 15ce3b89cf other minor demo tweaks Matt Hastings 2017-09-22 12:38:28 -04:00
  • 9e3a816502 Demo tweaks Matt Hastings 2017-09-22 12:07:00 -04:00
  • 277dfc53de Demo updates Matt Hastings 2017-09-21 13:28:05 -04:00
  • c940e1eaa5 Updating demo materials Matt Hastings 2017-09-20 08:35:47 -04:00
  • c63df6f649 Adds compressed etl files Dave Hull 2017-09-19 08:09:32 -05:00
  • 86f5df6462 Adding powershell logging Matt Hastings 2017-09-16 10:03:24 -04:00
  • a91a9646f9 Demo all the things Matt Hastings 2017-09-15 09:04:15 -04:00
  • f7bf024913 More demo updates Matt Hastings 2017-09-15 08:55:05 -04:00
  • 22f3463767 Minor tweaks to demo.txt Matt Hastings 2017-09-15 07:53:05 -04:00
  • d7a943dd9e Adding new demo.xml Matt Hastings 2017-09-15 07:49:25 -04:00
  • 16b9485683 Updating demo.txt Matt Hastings 2017-09-15 07:47:22 -04:00
  • 1721e11842 Fixing small thread parsing bug Matt Hastings 2017-09-15 07:42:46 -04:00
  • 3fc7c90eb5 Adds dcdemo files Dave Hull 2017-09-14 15:59:25 -05:00
  • 1a9d2204e4 Last readme updates for the night Matt Hastings 2017-09-11 21:12:53 -04:00
  • 5ab7930296 Readme changes Matt Hastings 2017-09-11 20:55:32 -04:00
  • 844751d7cf More Readme updates Matt Hastings 2017-09-11 20:51:18 -04:00
  • 6758069e63 Updating readme Matt Hastings 2017-09-11 20:49:28 -04:00
  • 8099446971 Adding demo content Matt Hastings 2017-09-07 22:02:54 -04:00
  • a0fe1d2b1d Final rename commit Matt Hastings 2017-09-04 21:33:00 -04:00
  • 227b8adafa Adding files for rename Matt Hastings 2017-09-04 21:05:09 -04:00
  • 96c77bde6b Renaming module Matt Hastings 2017-09-04 21:04:35 -04:00
  • 99c97f5f73 Adding more example in the readme Matt Hastings 2017-08-24 08:09:53 -04:00
  • d0df4073ad fixing a bunch of bugs Matt Hastings 2017-08-23 15:46:24 -04:00
  • 94fa674a06 Adding support for different logging levels Matt Hastings 2017-08-18 09:44:40 -04:00
  • 96d962b1bc Add new write-log function for console logging Matt Hastings 2017-08-18 09:34:42 -04:00
  • 6d48ae28c6 Fixing path and infinite loop bugs Matt Hastings 2017-08-18 08:41:44 -04:00
  • ecd8d4119b Updating readme Matt Hastings 2017-08-15 15:26:02 -04:00
  • 603246d388 Updating kernel session parsing code Matt Hastings 2017-08-15 11:23:24 -04:00
  • 3b4be2a7d6 Add in kernel session support to capture command line Matt Hastings 2017-08-14 17:53:19 -04:00
  • e18f3f0620 small change to readme Matt Hastings 2017-08-11 10:39:19 -04:00
  • d42f0afd94 Updating readme Matt Hastings 2017-08-11 10:32:33 -04:00
  • 563a4f9179 fixing minor bug in thread net connections Matt Hastings 2017-08-10 21:54:55 -04:00
  • 8c74ab9e74 Fixing bug in DNS tracking Matt Hastings 2017-08-08 10:27:48 -04:00
  • 0dd110e39c Major reword to support thread tracking Matt Hastings 2017-08-08 08:58:01 -04:00
  • 4e219109cf Add in thread keyword to forensic collection func Matt Hastings 2017-08-07 09:24:19 -04:00
  • 2b31524c73 Adding in thread start/stop events Matt Hastings 2017-08-07 09:13:34 -04:00
  • d4cb3dd2af Add in EnableVerbosity option to etwforensic func Matt Hastings 2017-08-06 12:43:57 -04:00
  • ae33ecb452 Removing debug strings Matt Hastings 2017-08-06 12:38:07 -04:00
  • 50d3bbb8c1 Fixing bug in filtering and dns Matt Hastings 2017-08-06 12:03:19 -04:00
  • adc491146f Updating DNS parsing Matt Hastings 2017-08-06 11:14:53 -04:00
  • d189c1b38e Adding DNS to etwforensic collection and log parsing Matt Hastings 2017-08-04 09:23:56 -04:00
  • 9175dbe50a Fixing image load bug with process end time Matt Hastings 2017-07-31 23:49:42 -04:00
  • cfce24d15c Adds DNS to Start-ETWForensicCollection Dave Hull 2017-07-18 13:02:20 -05:00
  • e9450b5a73 Adding DLLs for kernel session Matt Hastings 2017-07-03 08:33:21 -04:00
  • cd01839e54 Fix bug in process reuse code Matt Hastings 2017-06-27 20:39:57 -04:00
  • 5fda42f34e Add logic for process reuse Matt Hastings 2017-06-27 20:32:12 -04:00
  • 6ec4d7883c Fixing bug in process id parsing Matt Hastings 2017-06-27 18:51:28 -04:00
  • 56baf47e39 Adding in file event parser Matt Hastings 2017-06-26 00:06:36 -04:00
  • 8ebcf2c892 starting kernel file Matt Hastings 2017-06-24 20:12:34 -04:00
  • 2e9ad5ae3a Moves synopsis inside function Dave Hull 2017-06-20 09:00:27 -05:00
  • c3eeb6957b Adds .DS_Store Dave Hull 2017-06-20 08:38:53 -05:00
  • ac68001887 Adding provider exists check Matt Hastings 2017-06-11 20:58:35 -04:00
  • cc96433021 adding more notes to kernel process events Matt Hastings 2017-06-11 15:46:03 -04:00
  • 5d08c5823f Minor spelling fix Matt Hastings 2017-06-11 15:43:15 -04:00
  • 0ea84d6c9c Add Start-ETWForensicCollection function Matt Hastings 2017-06-11 15:41:35 -04:00
  • e9a82d27d4 Small change to docs Matt Hastings 2017-06-10 10:36:20 -04:00
  • efa0b4cc66 Adding network connection support Matt Hastings 2017-06-10 10:23:29 -04:00
  • f40c0f51ec Starting to add network events Matt Hastings 2017-06-09 22:01:13 -04:00
  • 550910d343 Remove failing test Matt Hastings 2017-06-09 17:37:09 -04:00
  • 3aa4ecc011 Updating function docs Matt Hastings 2017-06-06 19:26:48 -04:00
  • 1682fdaa77 Add parser for kernel process Matt Hastings 2017-06-08 23:45:35 -04:00
  • 5d5d012b03 Adds event parsing, but there's a bug Dave Hull 2017-06-08 15:44:15 -05:00
  • f267223d15 Adds some PoC work for parsing DNS events to objects Dave Hull 2017-06-07 09:56:16 -05:00
  • 48f4e4deba Adding more DNS info Dave Hull 2017-06-06 09:39:37 -05:00
  • 7d742eb4ea Adds DNS Event Ids and Descriptions Dave Hull 2017-06-05 09:59:41 -05:00
  • 81d04a3ffe Adding Providers and notes on DNS Dave Hull 2017-06-05 09:35:29 -05:00
  • fc60f61078 Ignoring etl files Dave Hull 2017-06-05 09:34:26 -05:00
  • eb2f2b635a Small update to process parser Matt Hastings 2017-06-01 23:46:16 -04:00
  • fce8325909 First parser commit Matt Hastings 2017-06-01 22:44:46 -04:00
  • 9522f46082 Get-ProviderKeywords to Get-ETWProviderKeywords Dave Hull 2017-05-31 11:17:11 -05:00
  • f9405483f3 small change to tests Matt Hastings 2017-05-30 23:50:46 -04:00
  • 7eb0a707e3 Pester tests now invoke full etw session Matt Hastings 2017-05-30 23:39:04 -04:00
  • f9ca4d5490 Fix start-session to accept object Matt Hastings 2017-05-30 14:58:01 -04:00
  • 7d52a807e8 Merge branch 'develop' of github.com:matthastings/PSalander into develop Matt Hastings 2017-05-30 14:57:16 -04:00
  • 57b3ed277d Merge branch 'develop' of github.com:matthastings/PSalander into develop Dave Hull 2017-05-30 13:08:54 -05:00
  • c62570691f Fix failing pester test Matt Hastings 2017-05-30 10:36:47 -04:00
  • abdb51e0f0 Add in keyword object Matt Hastings 2017-05-30 10:30:55 -04:00
  • a13326624d Adds provider directory and some notes Dave Hull 2017-05-27 10:16:19 -05:00
  • fff9047d31 Rearranged session enumeration functions Matt Hastings 2017-05-22 23:31:55 -04:00
  • 48b18e6024 Updating readme Matt Hastings 2017-05-22 21:49:58 -04:00
  • c51d624309 Add more pester testing Matt Hastings 2017-05-22 14:14:27 -04:00
  • 66a8d6b16c small change to etwsession function Matt Hastings 2017-05-22 11:05:59 -04:00
  • cd69948600 rearrange get-etwsession function Matt Hastings 2017-05-22 09:03:44 -04:00
  • 72deac8022 Adding more pester testing Matt Hastings 2017-05-22 08:37:44 -04:00
  • 200de2521a Starting to add pester tests Matt Hastings 2017-05-21 20:52:05 -04:00
  • dbcd6d0e44 Adding gitignore Matt Hastings 2017-05-19 10:31:39 -04:00
  • 9fd404513c Deleting old folders and adding new functions Matt Hastings 2017-05-19 10:29:57 -04:00
  • 6035bc72b8 working commit Matt Hastings 2017-05-18 15:50:42 -04:00
  • e0a485949b Add support for multiple ETW providers in single session Matt Hastings 2017-05-17 22:04:56 -04:00
  • 8a8b03cab7 rewording Matt Hastings 2017-04-17 21:16:12 -04:00
  • 262e5a5950 WIP commit Matt Hastings 2017-04-05 22:04:07 -04:00
  • 7d7fdcbb36 add stop session Matt Hastings 2017-04-04 22:05:54 -04:00
  • c4cbc21eea moving lib into EventTrace module Matt Hastings 2017-04-04 15:00:45 -04:00
  • 5f03fa9782 switch to module Matt Hastings 2017-04-04 14:55:23 -04:00
  • a578dcdc2c restructing dirs Matt Hastings 2017-04-01 20:00:29 -04:00