Windows notifier tool that detects suspicious connections by monitoring ETW event logs
☆125Dec 8, 2022Updated 3 years ago
Alternatives and similar repositories for ETWMonitor
Users that are interested in ETWMonitor are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A launcher to load a DLL with xored cobalt strike shellcode executed in memory through process hollowing technique☆27Nov 11, 2022Updated 3 years ago
- ☆117Aug 7, 2022Updated 4 years ago
- Python script for extracting and decrypting Group Policy Preferences passwords☆26May 28, 2021Updated 5 years ago
- WCRT CMake build☆11Mar 26, 2014Updated 12 years ago
- Enumerate various traits from Windows processes as an aid to threat hunting☆197Jan 13, 2022Updated 4 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Searching .evtx logs for remote connections☆24Jul 6, 2023Updated 3 years ago
- Deleting Shadow Copies In Pure C++☆118Oct 31, 2022Updated 3 years ago
- Small tool to play with IOCs caused by Imageload events☆47May 14, 2023Updated 3 years ago
- A Poc on blocking Procmon from monitoring network events☆111Aug 7, 2025Updated last year
- RemClip is a C# project which permits to steal user clipboard data and send it to a remote web server under attacker control☆15Sep 2, 2024Updated 2 years ago
- RPC Monitor based on The ETW Microsoft-Windows-Rpc provider☆24Mar 22, 2020Updated 6 years ago
- WTSRM☆213Aug 7, 2022Updated 4 years ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆321Mar 20, 2024Updated 2 years ago
- ☆163Dec 30, 2022Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all D…☆521Jul 31, 2024Updated 2 years ago
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆257Jul 9, 2024Updated 2 years ago
- Tools and PoCs for Windows syscall investigation.☆364Dec 2, 2025Updated 10 months ago
- Bypass Detection By Randomising ROR13 API Hashes☆140Feb 24, 2022Updated 4 years ago
- laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.☆505Jan 10, 2023Updated 3 years ago
- Example of async client/server sockets in .NET 5☆16Jun 9, 2021Updated 5 years ago
- apkfram was written in order to help any mobile penetration testers to identify the Framework used to develop the Android application.☆12Oct 9, 2024Updated 2 years ago
- Retrieve and display information about active user sessions on remote computers. No admin privileges required.☆211Aug 12, 2024Updated 2 years ago
- A C# port of https://gist.github.com/adamsvoboda/8f29e09d74b73e1dec3f9049c4358e80☆21Apr 2, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Six cases demonstrating methods of optimizing GetProcAddress☆18Jan 3, 2022Updated 4 years ago
- List the ETW provider(s) in the registration table of a process.☆79Sep 20, 2023Updated 3 years ago
- A simple WPF interface for Active Directory user password reset☆57Jun 11, 2024Updated 2 years ago
- Cmdlets for capturing Windows Events☆14Mar 11, 2022Updated 4 years ago
- Криптор на шелл-кодах☆11May 3, 2020Updated 6 years ago
- Ludus roles to deploy ASR rules and MDI auditing settings☆25Aug 5, 2025Updated last year
- Beacon Object File Loader☆292Dec 3, 2023Updated 2 years ago
- A fake AMSI Provider which can be used for persistence.☆158May 16, 2021Updated 5 years ago
- This aggressor script uses a beacon's note field to indicate the health status of a beacon.☆143Sep 29, 2021Updated 5 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Antivirus Signature Search Toolkit☆82Apr 30, 2023Updated 3 years ago
- ☆123Dec 23, 2022Updated 3 years ago
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆364Dec 19, 2022Updated 3 years ago
- rust clr heap encryption (https://github.com/lap1nou/CLR_Heap_encryption), but no heap encryption.☆17Jan 6, 2024Updated 2 years ago
- ☆104Oct 7, 2023Updated 3 years ago
- UAC bypass for x64 Windows 7 - 11☆847Feb 2, 2026Updated 8 months ago
- BYOVD collection☆24Mar 20, 2024Updated 2 years ago