Aether is a Windows memory-forensics and threat hunting tool that scans live process memory for malicious pattern, detect injection techniques, implant signatures, reflectively loaded .NET assemblies. it works with a multi-layer confidence model that dramatically reduce the false positive rate and hunt for malicious behaviour.
☆66Jul 5, 2026Updated 4 months ago
Alternatives and similar repositories for aether
Users that are interested in aether are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆91Jun 15, 2026Updated 4 months ago
- ⚡ Rust-accelerated temporal graph engine for cybersecurity threat hunting. Ingests 100M+ edges from PCAP/CSV on a single machine. Sub-sec…☆15Jul 30, 2026Updated 3 months ago
- Surgical UNWIND_INFO preservation for sleep masking without call stack spoofing.☆57Mar 30, 2026Updated 7 months ago
- (STILL.. EDR-evading) Password hash dumper for MacOS☆21Jul 8, 2026Updated 4 months ago
- A litterbox integration for the Mythic Command and Control Server☆21Sep 14, 2026Updated last month
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Always-on, cross-platform telemetry daemon for AI agent activity. Sysmon for AI agents.☆63Jul 28, 2026Updated 3 months ago
- Azure RedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID☆190Oct 18, 2026Updated 3 weeks ago
- Indicators of Normality☆11Jul 22, 2022Updated 4 years ago
- Cobalt Strike BOF for extracting Firefox passwords and cookies. Decrypts saved credentials using NSS, supports key3.db/key4.db, logins.js…☆42Jul 5, 2026Updated 4 months ago
- Repo hacks☆21Jul 30, 2026Updated 3 months ago
- Modern Web Application Firewall for Kong Gateway☆31Nov 3, 2026Updated last week
- Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antiv…☆568Mar 24, 2026Updated 7 months ago
- This repository contains the research tool presented at x33fcon 2026, along with the associated presentation slides. The content is made …☆66Jun 15, 2026Updated 4 months ago
- Evasive loader for .NET Framework assemblies☆84May 12, 2026Updated 6 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Helps defenders find their WSUS configurations in the wake of CVE-2025-59287☆46Oct 28, 2025Updated last year
- Python scripts that helps in the development of PPKG binaries☆17Jul 31, 2026Updated 3 months ago
- example use of defining your own injection technique for explicit injection and or spawn (fork & run)☆19Jan 3, 2026Updated 10 months ago
- Proof of concept to detect module stomping detection by looking for modified .pdata sections.☆41Jun 11, 2026Updated 5 months ago
- An example of how a driver can register a handle creation callback.☆16Jun 12, 2023Updated 3 years ago
- DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them agai…☆36Jul 28, 2026Updated 3 months ago
- Proof-of-concept security demo illustrating how PowerShell can create trusted-looking Windows toast notifications chained together with C…☆18Apr 12, 2026Updated 7 months ago
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 3 months ago
- Repository hosting a hypothetical EDR Spoofer, as discovered originally by Nightmare-Eclipse☆44May 27, 2026Updated 5 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- KslDump — Why bring your own knife when Defender already left one in the kitchen?☆420Apr 13, 2026Updated 6 months ago
- Phantom is project created to perform loading and executing unmanaged code in memory within an IIS environment running in full‑trust mode…☆108Jun 5, 2026Updated 5 months ago
- A small set of Beacon Object Files (BOFs) that I developed over the time with a Magic: The Gathering theme.☆22Jul 15, 2025Updated last year
- ☆37May 19, 2026Updated 5 months ago
- Windows memory scanner for call stack spoofing detection, unbacked shellcode, injected DLLs and in-memory C2 implants.☆38May 22, 2026Updated 5 months ago
- Hades is a fully-featured cross-platform Chrome Extension agent. Hades is designed for Mythic 3.0 and newer.☆49Aug 12, 2026Updated 3 months ago
- ☆14Oct 7, 2025Updated last year
- Blog/Journal on how to backdoor VSCode extensions☆84Feb 24, 2026Updated 8 months ago
- Browse and diff ETW provider snapshots across Windows builds. Backed by ETWInspector.☆40Sep 9, 2026Updated 2 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijac…☆165Jul 20, 2026Updated 3 months ago
- WasmForge — compile Go and C# programs to single-binary, WASM-sandboxed native executables with polymorphic output.☆134Jun 24, 2026Updated 4 months ago
- Async BOF that notifies the operator when a user connects to a local or remote target system.☆34Jul 30, 2026Updated 3 months ago
- Step through PE functions or shellcode instruction-by-instruction (amd64)☆43May 4, 2026Updated 6 months ago
- Sleep replacement that executes real, varied work to break behavioral pattern matching by EDR and anti-cheat systems☆92Jul 20, 2026Updated 3 months ago
- Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability☆24Feb 5, 2025Updated last year
- BingusLdr is a DLL loader built with Crystal Palace that uses a CET compatible stack spoofing technique.☆118Jul 14, 2026Updated 3 months ago
Are these results useful?