Alternatives and similar repositories for Microsoft-Vulnerable-Driver-Block-Lists

Users that are interested in Microsoft-Vulnerable-Driver-Block-Lists are comparing it to the libraries listed below

• t-tani / defender2yara
  Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules
  ☆135Updated this week
• jonny-jhnson / ETWInspector
  ☆180Updated 7 months ago
• OtterHacker / Hooker
  ☆108Updated last year
• reecdeep / hollowise
  Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis …
  ☆39Updated 9 months ago
• olafhartong / PockETWatcher
  a tiny program to consume from ETW providers for research
  ☆52Updated 11 months ago
• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆100Updated 5 months ago
• jonny-jhnson / JonMon-Lite
  ☆47Updated 5 months ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆91Updated last year
• eversinc33 / TriageMCP
  Vibe Malware Triage - MCP server for static PE analysis.
  ☆73Updated last week
• jdu2600 / Get-InjectedThreadEx
  Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
  ☆46Updated 2 years ago
• patrickmatula / Windows-Internals-Learning-Resources
  ☆110Updated last year
• xaitax / NTSleuth
  Comprehensive Windows Syscall Extraction & Analysis Framework
  ☆153Updated 3 months ago
• whokilleddb / sinister-vsix
  Blog/Journal on how to backdoor VSCode extensions
  ☆75Updated 4 months ago
• joe-desimone / rep-research
  ☆77Updated last year
• CroodSolutions / AutoRMM
  AutoRMM is a collection of scripts and instructions we are organizing, to test delivery mechanisms for RMM and screen sharing tools, alo…
  ☆91Updated 4 months ago
• mannyfred / MentalTi
  Mentally ill EtwTi parser
  ☆66Updated last month
• rad9800 / RansomFS
  ☆31Updated 9 months ago
• yo-yo-yo-jbo / commandline_spoofing
  Commandline spoofing on Windows
  ☆74Updated last week
• amjcyber / EDRNoiseMaker
  Detect WFP filters blocking EDR communications
  ☆95Updated last year
• mez-0 / citadel
  A Payload Analysis Framework
  ☆110Updated last month
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆163Updated last year
• Workday / raw-disk-parser
  A tool to interact with Windows drivers to perform a raw disk read and parse out target files without calling standard Windows file APIs
  ☆98Updated 3 months ago
• olafhartong / BamboozlEDR
  A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.
  ☆251Updated 2 months ago
• ignacioj / WhacAMole
  Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and en…
  ☆43Updated last year
• rad9800 / FileRenameJunctionsEDRDisable
  ☆159Updated 11 months ago
• warpnet / COM-Fuzzer
  Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…
  ☆149Updated last week
• BlackSnufkin / CheckPlz
  Scan files for potential threats while leveraging AMSI (Antimalware Scan Interface) and Windows Defender. By isolating malicious content.
  ☆33Updated 11 months ago
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆138Updated last year
• sidaf / moonshine
  ☆70Updated 2 years ago
• itaymigdal / PowerDodder
  Persist like a Dodder
  ☆66Updated 6 months ago