Alternatives and similar repositories for InsightEngineering

Users that are interested in InsightEngineering are comparing it to the libraries listed below

• magicsword-io / LOLDrivers
  Living Off The Land Drivers
  ☆1,205Updated last month
• Xacone / BestEdrOfTheMarket
  EDR Lab for Experimentation Purposes
  ☆1,273Updated last month
• daem0nc0re / TangledWinExec
  PoCs and tools for investigation of Windows process execution techniques
  ☆921Updated 2 weeks ago
• Faran-17 / Windows-Internals
  Important notes and topics on my journey towards mastering Windows Internals
  ☆394Updated last year
• matthieu-hackwitharts / Win32_Offensive_Cheatsheet
  Win32 and Kernel abusing techniques for pentesters
  ☆954Updated last year
• wavestone-cdt / EDRSandblast
  ☆1,664Updated 9 months ago
• ElliotKillick / operating-system-design-review
  Operating System Design Review: A systemic analysis of modern systems architecture
  ☆314Updated 3 months ago
• itaymigdal / awesome-injection
  Centralized resource for listing and organizing known injection techniques and POCs
  ☆577Updated 3 weeks ago
• cyberark / PipeViewer
  A tool that shows detailed information about named pipes in Windows
  ☆672Updated 7 months ago
• SafeBreach-Labs / PoolParty
  A set of fully-undetectable process injection techniques abusing Windows Thread Pools
  ☆1,124Updated last year
• vu-ls / Crassus
  ☆574Updated 2 weeks ago
• Bw3ll / sharem
  SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…
  ☆394Updated last month
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆752Updated last year
• Cracked5pider / Stardust
  A modern 32/64-bit position independent implant template
  ☆1,227Updated 3 months ago
• Accenture / Spartacus
  Spartacus DLL/COM Hijacking Toolkit
  ☆1,047Updated last year
• huntandhackett / process-cloning
  The Definitive Guide To Process Cloning on Windows
  ☆502Updated last year
• daem0nc0re / PrivFu
  Kernel mode WinDbg extension and PoCs for token privilege investigation.
  ☆864Updated 5 months ago
• nasbench / EVTX-ETW-Resources
  Event Tracing For Windows (ETW) Resources
  ☆389Updated 8 months ago
• netero1010 / EDRSilencer
  A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the …
  ☆1,673Updated 7 months ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆498Updated 7 months ago
• wietze / HijackLibs
  Project for tracking publicly disclosed DLL Hijacking opportunities.
  ☆768Updated this week
• LETHAL-FORENSICS / MemProcFS-Analyzer
  MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
  ☆635Updated this week
• Cracked5pider / LdrLibraryEx
  A small x64 library to load dll's into memory.
  ☆443Updated last year
• yardenshafir / WinDbg_Scripts
  Useful scripts for WinDbg using the debugger data model
  ☆414Updated last year
• tyranid / windows-security-internals
  A repository for additional files related to the book Windows Security Internals with PowerShell from No Starch Press.
  ☆185Updated last year
• ZeroMemoryEx / Terminator
  Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes
  ☆982Updated 2 years ago
• akamai / akamai-security-research
  This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.
  ☆505Updated last week
• x86matthew / WinVisor
  WinVisor - A hypervisor-based emulator for Windows x64 user-mode executables using Windows Hypervisor Platform API
  ☆579Updated 4 months ago
• hasherezade / mal_unpack
  Dynamic unpacker based on PE-sieve
  ☆736Updated 3 weeks ago
• jstrosch / learning-malware-analysis
  This repository contains sample programs that mimick behavior found in real-world malware. The goal is to provide source code that can be…
  ☆647Updated 11 months ago