Detection and recovery of NSA’s covered up tracks

Fox-IT analysed 'eventlogedit', a module from the leaked DanderSpritz framework that removes Windows .evtx event records by altering surrounding record headers rather than deleting data. The report demonstrates how deleted records can be fully recovered, provides an open-source Python detection/recovery script and a Windows executable (with hashes), and recommends scanning archived and centralized logs for evidence of use.