Mark Woan

LogViewer. LogViewer for viewing and searching large text files...

usbdeviceforensics. Python script for extracting USB information from Windows registry hives

LogViewer2. Application for viewing/searching large text/log files (WPF port of the original LogViewer)

autorunner. Emulates the Sysinternals Autoruns tool, but for DFIR purposes e.g. multi user processing

ForensicUserInfo. Extracts Windows user info including the password hashes

wmi-parser. Parses the WMI object database....looking for persistence

lookuper. Looks stuff up (MD5, SHA256, IP, Domains, URL's, strings e.g. mutexes)...

etw-event-dumper. C#

woanware.github.io. HTML

application-restriction-bypasses. A set of compiled application restriction bypasses

TargetAnalyser. Tool for analysts to perform simultaneous lookups (IP, Domain, URL, MD5) against multiple data sources

NetworkScanViewer. C#

JumpLister. C#

bgp-watcher. Prototype system to monitor BGP routes and alert when anomalies are identified

Win32Security. C#

SessionViewer. SessionViewer is a PCAP TCP session reconstructor with a UI to view the data flows, and export data

reg-entropy-scanner. Scans through registry hives outputting entropy values for key/values, dumps binary contents to files...we are looking for those "fileless" malwarez!

volatility-runner. volatility-runner is a command line application designed to speed up memory forensics using the volatility framework, primarily for instances where the user has multiple memory dumps to analyse.

log-file-decrufter. Go

win-catalog-dotnet. Managed library for accessing the Windows security catalog files

javaidx. C#

exefinder. C#

xor. C#

extract-web-domains. Tool to extract domains/IP's from files

filesender. Send files simply using Google Drive...it's a cross between https://github.com/schollz/croc and https://github.com/google/skicka

shimcacheparser. C#

EventLogParser. C#

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

VtLookup. C#

shellify. This is a fork from the Shellify project hosted on sourceforge. It replaces my own LNK parser as it has more features!

RegRipperRunner. C#

tr3_tool_kit. Repository to store the tools for Corey Harrell's Tr3Secure Data Collection script

VirtualDesktopUtils. The best Windows virtual desktop utility application in the world, probably, maybe, not......but even so it's very useful

snorbert. Snort data viewer...

word-password-generator. Console application to generate word based passwords using Mnemonicodes

threatexpertchecker. C#

logsifter. C#

ooxml-checker. Go

csv2xlsx. C#

RiskIqSharp. C# library (.Net 6) to interact with the RiskIQ/PassiveTotal API

csv-value-counter. A rewrite in golang of my .Net csvvaluecounter tool. Basically it counts the number of a particular field in a text file or CSV file

csvvaluecounter. C#

HttpKit. C#

log-sifter. Performs normalised levenshtein distance calculations on log entries to reduce repeated data...