Alternatives and similar repositories for InsightEngineering:

Users that are interested in InsightEngineering are comparing it to the libraries listed below

• magicsword-io / LOLDrivers
  Living Off The Land Drivers
  ☆1,112Updated this week
• daem0nc0re / TangledWinExec
  PoCs and tools for investigation of Windows process execution techniques
  ☆891Updated 3 months ago
• Faran-17 / Windows-Internals
  Important notes and topics on my journey towards mastering Windows Internals
  ☆364Updated 10 months ago
• Xacone / BestEdrOfTheMarket
  AV/EDR Evasion Lab for Training & Learning Purposes
  ☆1,197Updated 2 weeks ago
• wavestone-cdt / EDRSandblast
  ☆1,597Updated 6 months ago
• vu-ls / Crassus
  ☆569Updated 3 months ago
• cyberark / PipeViewer
  A tool that shows detailed information about named pipes in Windows
  ☆612Updated 3 months ago
• matthieu-hackwitharts / Win32_Offensive_Cheatsheet
  Win32 and Kernel abusing techniques for pentesters
  ☆940Updated last year
• jstrosch / learning-malware-analysis
  This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be…
  ☆628Updated 7 months ago
• daem0nc0re / PrivFu
  Kernel mode WinDbg extension and PoCs for token privilege investigation.
  ☆835Updated last month
• persistence-info / persistence-info.github.io
  ☆486Updated last year
• Accenture / Spartacus
  Spartacus DLL/COM Hijacking Toolkit
  ☆1,019Updated last year
• akamai / akamai-security-research
  This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.
  ☆488Updated 2 months ago
• netero1010 / EDRSilencer
  A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the …
  ☆1,604Updated 4 months ago
• hasherezade / mal_unpack
  Dynamic unpacker based on PE-sieve
  ☆706Updated 3 weeks ago
• SafeBreach-Labs / PoolParty
  A set of fully-undetectable process injection techniques abusing Windows Thread Pools
  ☆1,058Updated last year
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆731Updated 11 months ago
• diversenok / TokenUniverse
  An advanced tool for working with access tokens and Windows security policy.
  ☆589Updated 7 months ago
• Bw3ll / sharem
  SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…
  ☆383Updated 4 months ago
• Mr-Un1k0d3r / EDRs
  ☆2,046Updated 2 years ago
• ZeroMemoryEx / Terminator
  Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes
  ☆947Updated last year
• Cracked5pider / Stardust
  A modern 64-bit position independent implant template
  ☆1,110Updated 9 months ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆457Updated 4 months ago
• Wra7h / FlavorTown
  Various ways to execute shellcode
  ☆483Updated 11 months ago
• commial / experiments
  Expriments
  ☆452Updated 5 months ago
• yardenshafir / WinDbg_Scripts
  Useful scripts for WinDbg using the debugger data model
  ☆402Updated 11 months ago
• lem0nSec / ShellGhost
  A memory-based evasion technique which makes shellcode invisible from process start to end.
  ☆1,168Updated last year
• VirtualAlllocEx / DEFCON-31-Syscalls-Workshop
  Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".
  ☆650Updated last year
• wietze / HijackLibs
  Project for tracking publicly disclosed DLL Hijacking opportunities.
  ☆708Updated last week
• nop-tech / OSED
  Containing my notes, practice binaries + solutions, blog posts, etc. for the Offensive Security Exploit Developer (OSED/EXP-301)
  ☆621Updated 6 months ago