-
Notifications
You must be signed in to change notification settings - Fork 120
Parsers
saleh muhaysin edited this page Mar 31, 2021
·
7 revisions
The following are parsers used in Kuiper project, some are custom built, and others have been modified to output the results in a compliant format in order to integrate it with Kuiper and some have been heavily modified to make it compatible with Kuiper.
| Parser | Author |
|---|---|
| Amcache | Willi Ballenthin |
| AppCompatFlags | Muteb Alqahtani |
| Bam | Muteb Alqahtani |
| BrowserHistory | Saleh Muhaysin |
| ComputerName | Muteb Alqahtani |
| CSV | Custom by Saleh Muhaysin |
| DHCP | Muteb Alqahtani |
| Events | Omer BenAmram |
| InstalledApp | Muteb Alqahtani |
| InstalledComponents | Muteb Alqahtani |
| Jumplist | Saleh Muhaysin |
| LastVisitedMRU | Muteb Alqahtani |
| LaunchTracing | Muteb Alqahtani |
| LNK | Saleh Muhaysin |
| MFT_parser | Omer BenAmram |
| MuiCache | Muteb Alqahtani |
| OpenSaveMRU | Muteb Alqahtani |
| PowerShellHistory | Custom by Saleh Muhaysin |
| Prefetch | MBromiley |
| ProfileList | Muteb Alqahtani |
| Recyclebin | Custom by Muteb Alqahtani |
| RUA | davidpany |
| RunMRU | Muteb Alqahtani |
| sccm_parser | Custom by Muteb Alqahtani & AbdulRhman Alfaifi |
| Scheduled Tasks | Custom by Muteb Alqahtani |
| Services | Custom by Saleh Muhaysin |
| Shellbags | Willi Ballenthin |
| ShellExtensions | Muteb Alqahtani |
| Shimcache | MANDIANT |
| Srum | Saleh Muhaysin |
| Sysinternals | Muteb Alqahtani |
| TerminalServerClient | Muteb Alqahtani |
| TimeZoneInformation | Muteb Alqahtani |
| TypedUrls | Muteb Alqahtani |
| Uninstall | Muteb Alqahtani |
| UserAssist | Muteb Alqahtani |
| UsnJrnl | PoorBillionaire |
| WER | Custom by Muteb Alqahtani & AbdulRhman Alfaifi |
| WMI_Persistence | davidpany |
| WordWheelQuery | Muteb Alqahtani |
| mem_cmdline | Volatility3 |
| mem_pslist | Volatility3 |
| mem_timeliner | Volatility3 |
| mem_virtMap | Volatility3 |
| mem_vadInfo | Volatility3 |
| mem_symlink | Volatility3 |
| mem_userAssist | Volatility3 |
| mem_hiveList | Volatility3 |
| mem_ProcessPrivs | Volatility3 |
| mem_netScan | Volatility3 |
| mem_mutantScan | Volatility3 |
| mem_Modules | Volatility3 |
| mem_ModScan | Volatility3 |
| mem_handles | Volatility3 |
| mem_ProcessSID | Volatility3 |
| mem_FileScan | Volatility3 |
| mem_envars | Volatility3 |
| mem_info | Volatility3 |
| mem_SSDT | Volatility3 |
| mem_dlllist | Volatility3 |
| IIS_Compare | Omar Alabdulwahab |
| IIS_Modules | Omar Alabdulwahab |
| IIS_Sites | Omar Alabdulwahab |
| RecentFileCache | Ahmed Alghamdi |
| CertUtilParser | AbdulRhman Alfaifi |
To add your own parser on Kuiper, read documentation Add Custom Parser