Windows notifier tool that detects suspicious connections by monitoring ETW event logs
☆125Dec 8, 2022Updated 3 years ago
Alternatives and similar repositories for ETWMonitor
Users that are interested in ETWMonitor are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- VULNSPY regularly retrieves the latest alerts published by the CERT-FR and the related vulnerabilities with their CVSS score and allows y…☆38Nov 3, 2022Updated 3 years ago
- A launcher to load a DLL with xored cobalt strike shellcode executed in memory through process hollowing technique☆27Nov 11, 2022Updated 3 years ago
- Python script for extracting and decrypting Group Policy Preferences passwords☆26May 28, 2021Updated 5 years ago
- Enumerate various traits from Windows processes as an aid to threat hunting☆197Jan 13, 2022Updated 4 years ago
- Sleep Obfuscation☆45Oct 13, 2022Updated 4 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Dump Teams conversations☆18Jun 9, 2021Updated 5 years ago
- ☆117Aug 7, 2022Updated 4 years ago
- RPC Monitor based on The ETW Microsoft-Windows-Rpc provider☆24Mar 22, 2020Updated 6 years ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆322Mar 20, 2024Updated 2 years ago
- Infect Shared Files In Memory for Lateral Movement☆189Dec 14, 2022Updated 3 years ago
- Bypass Detection By Randomising ROR13 API Hashes☆140Feb 24, 2022Updated 4 years ago
- Sysmon-Like research tool for ETW☆397Nov 15, 2022Updated 3 years ago
- A fake AMSI Provider which can be used for persistence.☆159May 16, 2021Updated 5 years ago
- RemClip is a C# project which permits to steal user clipboard data and send it to a remote web server under attacker control☆15Sep 2, 2024Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Deleting Shadow Copies In Pure C++☆118Oct 31, 2022Updated 3 years ago
- A Poc on blocking Procmon from monitoring network events☆111Aug 7, 2025Updated last year
- Example of async client/server sockets in .NET 5☆16Jun 9, 2021Updated 5 years ago
- Collection of my own detection rules☆20Oct 21, 2026Updated last week
- A repository filled with ideas to break/detect direct syscall techniques☆25Apr 21, 2022Updated 4 years ago
- Tools and PoCs for Windows syscall investigation.☆364Dec 2, 2025Updated 10 months ago
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆258Jul 9, 2024Updated 2 years ago
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆364Dec 19, 2022Updated 3 years ago
- ☆93Aug 23, 2021Updated 5 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- 💻 Windows 10 Kernel-mode rootkit☆30Sep 3, 2022Updated 4 years ago
- ☆162Dec 30, 2022Updated 3 years ago
- A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC☆374May 24, 2022Updated 4 years ago
- UUID based Shellcode loader for your favorite C2☆86Dec 8, 2021Updated 4 years ago
- A simple commandline application to automatically decrypt strings from Obfuscator protected binaries☆48Jun 15, 2024Updated 2 years ago
- Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all D…☆519Jul 31, 2024Updated 2 years ago
- Ludus roles to deploy ASR rules and MDI auditing settings☆25Aug 5, 2025Updated last year
- Un dropper de payload indétectable qui désactive l'antivirus Windows Defender puis paramètre un fichier batch à l'ouverture de session de…☆13Mar 6, 2021Updated 5 years ago
- This aggressor script uses a beacon's note field to indicate the health status of a beacon.☆143Sep 29, 2021Updated 5 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Cobalt Strike BOF that uses a custom ASM HalosGate & HellsGate syscaller to return a list of processes☆107Mar 8, 2023Updated 3 years ago
- PoCs and tools for investigation of Windows process execution techniques☆960Feb 2, 2026Updated 8 months ago
- Some stuff for PHD2021☆14May 21, 2025Updated last year
- BYOVD collection☆25Mar 20, 2024Updated 2 years ago
- A C# implementation of dumping credentials from Windows Credential Manager☆64Sep 23, 2023Updated 3 years ago
- BOF combination of KillDefender and Backstab☆169Mar 23, 2023Updated 3 years ago
- Quick and dirty PoSH code to read teams messages☆23Feb 5, 2025Updated last year