Alternatives and similar repositories for etw-dns

Users that are interested in etw-dns are comparing it to the libraries listed below

• 0xhido / BlueLight
  Open-source EDR kernel-component for system monitoring and DLL injection
  ☆31Updated 4 years ago
• TimelifeCzy / HIPS-HIDS_CveMod
  Windows CVE主防(HIPS/HIDS)
  ☆54Updated 4 years ago
• y11en / PEBFake
  PEBFake(修改PEB 伪装当前进程路径、参数等)
  ☆51Updated 4 years ago
• muxq / hellorpc
  windows rpc 使用MIDL+RPC实现HelloWorld
  ☆23Updated 7 years ago
• splunk / PPLinject
  Inject unsigned DLL into Protected Process Light (PPL)
  ☆24Updated 3 weeks ago
• h0li3 / mpengine_diskus
  参考taviso的代码逆向一下mpengine.dll
  ☆19Updated 2 years ago
• singlefreshBird / Rootkit
  Rookit and anti rookit on Windows platform
  ☆12Updated last year
• huoji120 / Etw-Syscall
  https://key08.com/index.php/2021/10/19/1375.html
  ☆67Updated 3 years ago
• elastic / PPLGuard
  ☆70Updated 4 months ago
• TeamT5 / ShimcacheParser
  A simple parser(library) which extracts shimcache data from windows.
  ☆14Updated 6 years ago
• bopin2020 / WindowsCamp
  Windows Kernel Knowledge && Collect Resources on the wire && Nothing innovation by myself &&
  ☆55Updated 3 weeks ago
• D0pam1ne705 / Direct-NtCreateUserProcess
  Call NtCreateUserProcess directly as normal.
  ☆71Updated 3 years ago
• V3ded / Blog-Lab
  Source files for my posts
  ☆16Updated last year
• n4r1b / WdFilter-Research
  Data and structures regarding the research done on WdFilter
  ☆12Updated 5 years ago
• hongson11698 / defender-database-extract
  defender_database
  ☆17Updated last year
• OxNinja / C-VM
  My try to implement a virtual CPU in C
  ☆19Updated last year
• Cc28256 / ObfuscateP
  编译时混淆字符串，以确保生成的二进制PE不会暴漏明文字符串。（C++ 14 及以上）
  ☆26Updated 3 years ago
• idiotc4t / RandomInjector
  This is a random process injector, and more injection techniques will be added in the future.
  ☆13Updated 4 years ago
• theSecHunter / Hades-Linux
  Hades is a Host-Based Intrusion Detection System based on both eBPF(kernel) and netlink/cn_proc(userspace).
  ☆24Updated 5 months ago
• huoji120 / Microsoft_Kernel_Memory_Leak
  win32kbase!NtDCompositionCommitSynchronizationObject and win32kbase!NtGdiGetCertificate
  ☆16Updated 3 years ago
• DamonMohammadbagher / ETWNetMonv3
  ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW & ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Ima…
  ☆39Updated 2 years ago
• HadesW / HttpRAT
  HTTPS GET RAT and Memory Loader
  ☆25Updated 2 years ago
• WBGlIl / mhydump
  ☆22Updated 4 years ago
• waleedassar / SyscallNumberFinder
  ☆33Updated 3 years ago
• iHackerJi / MiniWfp
  基于WFP的小型网络过滤驱动，拦截百度的DNS，感谢公司前辈们的思路与指导。
  ☆14Updated 3 years ago
• SLAUC91 / DLLFinder
  Enumerate the DLLs/Modules using NtQueryVirtualMemory
  ☆32Updated 9 years ago
• Gilfoylex / windows_hack_teach
  windows 黑客技术编程技术详解配套的代码资源
  ☆15Updated 5 years ago
• wonderkun / kernalApc
  inject dll from kernal mode to user mode process use Apc
  ☆32Updated 5 years ago
• yardenshafir / MitigationFlagsCliTool
  Command like tool to print mitigation flags for running processes in a memory dump
  ☆46Updated 4 years ago
• wecooperate / iSwordSDK
  iSwordSDK （Provide Powerful Kernel API For Ring3 Applications）
  ☆15Updated 3 years ago