EVTX Triage Toolkit (EvtxHound)
A high-performance Python CLI utility designed for incident responders and SOC analysts to quickly parse Windows Event Logs (.evtx) and identify suspicious parent-child process relationships.
Features
- Parses
Security.evtxandSysmon.evtxlocally. - Identifies LOLBin (Living Off The Land Binaries) anomalies (e.g.
word.exespawningcmd.exe). - Outputs findings to console, JSON, or CSV.
Usage
pip install -r requirements.txt
python triage.py --file Security.evtx --output results.json
1 maintainer
Metadata
1 maintainer
Release files for evtx-hound 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| evtx_hound-0.2.0.tar.gz | 4.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| evtx_hound-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 8.3 kB
Release files / evtx_hound-0.2.0.tar.gz
| Download URL | evtx_hound-0.2.0.tar.gz |
|---|---|
| Size | 4.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
506e171c0014ed762853769f78748c3356ec56809a26f02f80227c6e30fdf365
|
|
BLAKE2b-256 checksum How to use checksums |
c261c451bfd7c8590ac68d37acda98324ca4180f55a8684a0ca5e0a8c7e7e7da
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
Release files / evtx_hound-0.2.0-py3-none-any.whl
| Download URL | evtx_hound-0.2.0-py3-none-any.whl |
|---|---|
| Size | 4.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7d19d551bbf118ccbd0b6bd2e0715e666c19a99451bdd512fd7cbc9467cdd3b9
|
|
BLAKE2b-256 checksum How to use checksums |
5989f188435eca32d509c354bbf6f24d974cf2380cf43a982b53d140f6ec4bb6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
