EVTX Triage Toolkit
A high-performance Python CLI utility designed for incident responders and SOC analysts to quickly parse Windows Event Logs (.evtx) and identify suspicious parent-child process relationships.
Features
- Parses
Security.evtxandSysmon.evtxlocally. - Identifies LOLBin (Living Off The Land Binaries) anomalies (e.g.
word.exespawningcmd.exe). - Outputs findings to console, JSON, or CSV.
Usage
pip install -r requirements.txt
python triage.py --file Security.evtx --output results.json
1 maintainer
Metadata
1 maintainer
Release files for evtx-hound 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| evtx_hound-0.1.0.tar.gz | 3.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| evtx_hound-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 7.5 kB
Release files / evtx_hound-0.1.0.tar.gz
| Download URL | evtx_hound-0.1.0.tar.gz |
|---|---|
| Size | 3.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b75c704caa1ac135cdbf40ecfe967764a8c97d74653be24ad0c2ed142753c1de
|
|
BLAKE2b-256 checksum How to use checksums |
d58a5009eedd8c28a11297332ce4e4d46b3a6a8028f6f716b3a92e9471205161
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
Release files / evtx_hound-0.1.0-py3-none-any.whl
| Download URL | evtx_hound-0.1.0-py3-none-any.whl |
|---|---|
| Size | 3.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
00ea743a293499b33a230f1f9f357ee7b97ea66297fb24b0ea7096e04e050223
|
|
BLAKE2b-256 checksum How to use checksums |
039f71dd6e956b157ad748434c6d71f14e3dfaaf3458c272bbdd15b554d5a5b1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
