ELAT (Event Log Analysis Tool)

A Command Line Map-Reduce tool for analyzing cowrie log files over time and creating visualizations and statistics.

I drew inspiration for EventShot from the tool regshot, which takes snapshots of the registry, and I applied that same concept to the event logs.

The EventShot script captures a snapshot of the selected event log(s) and then takes a second snapshot after you complete your analysis. It compares the two files and parses the output to highlight differences. EventScan can either scan live system event logs against the EventLogIndicators directory containing YARA signatures, or you can place event log files in the SCAN directory and search them using your YARA signatures. Together, these tools and YARA signatures provide analysts with a comprehensive method to scope and detect malware using Windows event logs. I recommend using the Windows executable versions of EventScan and EventShot, which can be found in both the EventScan directory and the EventShot directory. Please ensure both tools are run with administrative privileges. EventShot - The root directory includes a file named whitelist.txt. This file already contains several processes that I have added based on my own malware analysis. You can add noisy processes to this file using Python regex (e.g., Windows\system32\svchost.exe or simply svchost.exe).