process doppelganging and herpaderping artifact detector — free browser tool | fatcousin

drop sysmon evtx csv · detect process doppelganging and herpaderping artifacts · identify transacted ntfs file writes followed by execution · surface advanced in-memory evasion techniques · runs locally

evtx csv

drop sysmon · security evtx csv

or click

Select file

sysmon 1/11/25/23 · security 4688 — evtxecmd export

drop sysmon evtx csv

ready