ProcessusT / ETWMonitorLinks
Windows notifier tool that detects suspicious connections by monitoring ETW event logs
☆120Updated 3 years ago
Alternatives and similar repositories for ETWMonitor
Users that are interested in ETWMonitor are comparing it to the libraries listed below
Sorting:
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and en…☆43Updated last year
- Collection of scripts to retrieve stored passwords from Veeam Backup☆142Updated 6 months ago
- Default Detections for EDR☆96Updated last year
- Privileger is a tool to work with Windows Privileges☆139Updated 2 years ago
- A collection of small scripts and tools for deobfuscation and malware analysis.☆66Updated 2 years ago
- ☆84Updated 3 years ago
- ☆68Updated 3 years ago
- ☆121Updated last year
- Updated version of PowerDNS by @domchell. Adds support for transfers over DNS A records and a few other useful features.☆83Updated 2 years ago
- ☆192Updated last year
- The ldap2json script allows you to extract the whole LDAP content of a Windows domain into a JSON file.☆141Updated last year
- Deleting Shadow Copies In Pure C++☆117Updated 3 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆91Updated 3 years ago
- Create and enumerate hidden desktops.☆88Updated 2 years ago
- Spoofing desktop login applications with WinForms and WPF☆176Updated last year
- Microsoft Signed PowerShell scripts☆220Updated 2 years ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆223Updated 2 years ago
- A C# based tool for analysing malicious OneNote documents☆118Updated 2 years ago
- Analyse MSI files for vulnerabilities☆140Updated last year
- A CIA tradecraft technique to asynchronously detect when a process is created using WMI.☆138Updated last year
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆139Updated last year
- DNS Tunneling using powershell to download and execute a payload. Works in CLM.☆229Updated 3 years ago
- Detect WFP filters blocking EDR communications☆96Updated last year
- Scan vulnerable drivers on Windows with loldrivers.io☆186Updated 2 years ago
- Repository for archiving Cobalt Strike configuration☆35Updated this week
- A proof-of-concept for (CVE-2023-38840) that extracts plaintext master passwords from a locked Bitwarden vault.☆41Updated last year
- POC for frustrating/defeating Malware Analysts☆157Updated 3 years ago
- Infect Shared Files In Memory for Lateral Movement☆196Updated 3 years ago
- Powershell implementation of a novel technique. Invoke-GPTObfuscation is a PowerShell Obfuscator that utilizes OpenAI (and other APIs) to…☆48Updated 2 years ago