airbus-cert / WinsharkLinks
A wireshark plugin to instrument ETW
☆575Updated 3 years ago
Alternatives and similar repositories for Winshark
Users that are interested in Winshark are comparing it to the libraries listed below
Sorting:
- Encyclopedia for Executables☆459Updated 4 years ago
- ☆803Updated 2 years ago
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆584Updated last year
- Event Tracing For Windows (ETW) Resources☆407Updated 3 weeks ago
- View ETW Provider manifest☆548Updated last year
- ☆530Updated 5 months ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆811Updated 4 years ago
- Standard collection of rules for capa: the tool for enumerating the capabilities of programs☆651Updated last week
- Live hunting of code injection techniques☆383Updated 6 years ago
- Sysmon EDR POC Build within Powershell to prove ability.☆226Updated 4 years ago
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆315Updated last year
- ☆151Updated last year
- The multi-platform memory acquisition tool.☆891Updated last month
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆428Updated 5 years ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆788Updated last year
- Dynamic unpacker based on PE-sieve☆782Updated 2 months ago
- $MFT directory tree reconstruction & FILE record info☆320Updated last year
- Expriments☆475Updated last year
- PowerShell script for deobfuscating encoded PowerShell scripts☆428Updated 4 years ago
- Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launche…☆264Updated 3 years ago
- Windows Registry Knowledge Base☆189Updated this week
- Collection of malware persistence and hunting information. Be a persistent persistence hunter!☆182Updated last month
- Parses $MFT from NTFS file systems☆279Updated 6 months ago
- Sysmon-Like research tool for ETW☆368Updated 3 years ago
- Detect and respond to Cobalt Strike beacons using ETW.☆509Updated 3 years ago
- Prefetch Explorer Command Line☆275Updated 10 months ago
- All sysmon event types and their fields explained☆560Updated 4 years ago
- C# based evtx parser with lots of extras☆335Updated 2 months ago
- ☆481Updated 2 years ago
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆749Updated 4 years ago