Alternatives and similar repositories for SysmonEoP:

Users that are interested in SysmonEoP are comparing it to the libraries listed below

• nettitude / ETWHash
  C# POC to extract NetNTLMv1/v2 hashes from ETW provider
  ☆252Updated last year
• Mr-Un1k0d3r / AMSI-ETW-Patch
  Patch AMSI and ETW
  ☆235Updated 9 months ago
• Wh04m1001 / CVE-2023-29343
  ☆160Updated last year
• Kudaes / Dumpy
  Reuse open handles to dynamically dump LSASS.
  ☆235Updated 10 months ago
• mdsecactivebreach / DragonCastle
  A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process.
  ☆294Updated 2 years ago
• OmriBaso / RToolZ
  A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.
  ☆318Updated 2 years ago
• SaadAhla / AMSI_patch
  Patching AmsiOpenSession by forcing an error branching
  ☆143Updated last year
• wavvs / nanorobeus
  COFF file (BOF) for managing Kerberos tickets.
  ☆288Updated last year
• smokeme / airstrike
  ☆159Updated 6 months ago
• florylsk / SignatureGate
  Weaponized HellsGate/SigFlip
  ☆198Updated last year
• SaadAhla / GithubC2
  Github as C2 Demonstration , free API = free C2 Infrastructure
  ☆132Updated last year
• WKL-Sec / dcomhijack
  Lateral Movement Using DCOM and DLL Hijacking
  ☆283Updated last year
• nettitude / Tartarus-TpAllocInject
  ☆180Updated last year
• hrtywhy / BOF-CobaltStrike
  Useful Cobalt Strike Beacon Object Files (BOFs) used during red teaming and penetration testing engagements.
  ☆92Updated 2 years ago
• waldo-irc / YouMayPasser
  You shall pass
  ☆254Updated 2 years ago
• xenoscr / SysWhispers2
  AV/EDR evasion via direct system calls.
  ☆107Updated last year
• OmriBaso / WTSImpersonator
  WTSImpersonator utilizes WTSQueryUserToken to steal user tokens by abusing the RPC Named Pipe "\\pipe\LSM_API_service"
  ☆118Updated 7 months ago
• xpn / ntlmquic
  POC tools for exploring SMB over QUIC protocol
  ☆121Updated 2 years ago
• mandiant / ccmpwn
  ☆190Updated 10 months ago
• S4ntiagoP / donut
  Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…
  ☆111Updated last year
• klezVirus / NimlineWhispers3
  A tool for converting SysWhispers3 syscalls for use with Nim projects
  ☆143Updated 2 years ago
• N4kedTurtle / PersistBOF
  A BOF to automate common persistence tasks for red teamers
  ☆273Updated last year
• eladshamir / RPC-Backdoor
  A basic emulation of an "RPC Backdoor"
  ☆240Updated 2 years ago
• MzHmO / psexec_noinstall
  Repository contains psexec, which will help to exploit the forgotten pipe
  ☆166Updated 3 months ago
• binderlabs / DirCreate2System
  Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting
  ☆357Updated 2 years ago
• praetorian-inc / ADFSRelay
  Proof of Concept Utilities Developed to Research NTLM Relaying Attacks Targeting ADFS
  ☆175Updated 2 years ago
• SaadAhla / ntdlll-unhooking-collection
  different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)
  ☆184Updated last year
• MzHmO / TGSThief
  My implementation of the GIUDA project in C++
  ☆167Updated last year
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆250Updated last year
• rasta-mouse / process-inject-kit
  Port of Cobalt Strike's Process Inject Kit
  ☆165Updated 2 months ago