SadProcessor / EzETWLinks
Cmdlets for capturing Windows Events
☆14Updated 3 years ago
Alternatives and similar repositories for EzETW
Users that are interested in EzETW are comparing it to the libraries listed below
Sorting:
- This project provides Base64 encoding and decoding functionality to PowerShell within Constrained Language Mode☆27Updated last year
- Go module that allows you to authenticate to Azure with a well known client ID using interactive logon and grab the token☆26Updated 3 years ago
- ☆15Updated 7 years ago
- Takes the original idea of NetCease and adds functionality☆24Updated 3 years ago
- ☆23Updated 10 months ago
- Platform independent library for interfacing windows security descriptors☆22Updated this week
- Threat Mitigation Strategies☆26Updated 4 months ago
- Looks up permissions within Active Directory on a target (OU or Computer) to determine access to LAPS attributes (ms-Mcs-AdmPwdExpiration…☆16Updated 2 years ago
- Active Directory Toolkit☆20Updated 6 years ago
- Proof of concept - Covert Channel using Windows Filtering Platform (C#)☆21Updated 4 years ago
- Kibana app for RedELK☆18Updated 2 years ago
- A collection of my presentation materials.☆17Updated last year
- Evtx Log (xml) Browser☆56Updated 2 years ago
- Track previous changes on specific AD accounts (users, computers) and Groups (online DC), even if event logs were wiped/not collected (e.…☆16Updated 10 months ago
- Active Directory Group Policy analyzer☆18Updated 6 years ago
- Just a bunch of code snippets to identify and remediate common Active Directory Certificate Services issues.☆35Updated last year
- Accompanying PowerShell Modules for DevSec Defense Presentation☆30Updated 7 years ago
- Loading and executing shellcode in C# without PInvoke.☆22Updated 3 years ago
- A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection☆32Updated 5 years ago
- BloodHound Data Scanner☆45Updated 5 years ago
- A Canary which fires when uninstalled☆34Updated 4 years ago
- A PowerShell script to prevent Sysmon from writing its events☆16Updated 5 years ago
- A tool for leveraging elevated acess over a computer to boot the computer into Windows Safe Mode, alter settings, and then boot back into…☆16Updated 4 years ago
- Extracts Azure authentication tokens from PowerShell process minidumps.☆22Updated 2 years ago
- Indicators of Normality☆11Updated 3 years ago
- Quick and dirty PoSH code to read teams messages☆23Updated 11 months ago
- Minimalist Custom .NET Core Garbage Collector☆23Updated 5 years ago
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆16Updated 5 years ago
- USB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is exec…☆20Updated 3 years ago
- C# Implementation of Jared Atkinson's Get-InjectedThread.ps1☆53Updated 4 years ago