Alternatives and similar repositories for RPCMon:

Users that are interested in RPCMon are comparing it to the libraries listed below

• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆352Updated 2 years ago
• trailofbits / RpcInvestigator
  Exploring RPC interfaces on Windows
  ☆320Updated last year
• zeroperil / HookDump
  Security product hook detection
  ☆317Updated 3 years ago
• br-sn / CheekyBlinder
  Enumerating and removing kernel callbacks using signed vulnerable drivers
  ☆554Updated 2 years ago
• commial / experiments
  Expriments
  ☆452Updated 5 months ago
• jdu2600 / Windows10EtwEvents
  Events from all manifest-based and mof-based ETW providers across Windows 10 versions
  ☆288Updated 10 months ago
• xuanxuan0 / TiEtwAgent
  PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
  ☆269Updated 3 years ago
• jsecurity101 / MSRPC-to-ATTACK
  A repository that maps commonly used attacks using MSRPC protocols to ATT&CK
  ☆321Updated last year
• APTortellini / unDefender
  Killing your preferred antimalware by abusing native symbolic links and NT paths.
  ☆357Updated 3 years ago
• DamonMohammadbagher / ETWProcessMon2
  ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…
  ☆299Updated last year
• deepinstinct / Dirty-Vanity
  A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…
  ☆633Updated 2 years ago
• daem0nc0re / AtomicSyscall
  Tools and PoCs for Windows syscall investigation.
  ☆359Updated 2 months ago
• RedSection / OffensivePH
  OffensivePH - use old Process Hacker driver to bypass several user-mode access controls
  ☆329Updated 3 years ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆465Updated 4 months ago
• rajiv2790 / FalconEye
  ☆295Updated 3 years ago
• mgeeky / UnhookMe
  UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …
  ☆344Updated 2 years ago
• rad9800 / TamperingSyscalls
  ☆474Updated 2 years ago
• daem0nc0re / TangledWinExec
  PoCs and tools for investigation of Windows process execution techniques
  ☆912Updated last week
• hasherezade / process_overwriting
  Yet another variant of Process Hollowing
  ☆384Updated last month
• HackingLZ / ExtractedDefender
  ☆214Updated 2 years ago
• pathtofile / PPLRunner
  Run Processes as PPL with ELAM
  ☆154Updated 3 years ago
• itm4n / PPLdump
  Dump the memory of a PPL with a userland exploit
  ☆866Updated 2 years ago
• csandker / InterProcessCommunication-Samples
  Some Code Samples for Windows based Inter-Process-Communication (IPC)
  ☆169Updated last year
• slyd0g / PrimaryTokenTheft
  Steal a primary token and spawn cmd.exe using the stolen token
  ☆254Updated 4 years ago
• Dec0ne / DllNotificationInjection
  A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and re…
  ☆445Updated last year
• crummie5 / FreshyCalls
  FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!
  ☆325Updated 2 years ago
• hfiref0x / WDExtract
  Extract Windows Defender database from vdm files and unpack it
  ☆437Updated 5 years ago
• itm4n / PPLmedic
  Dump the memory of any PPL with a Userland exploit chain
  ☆333Updated 2 years ago
• NUL0x4C / KnownDllUnhook
  Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs
  ☆294Updated 2 years ago
• Dec0ne / HWSyscalls
  HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.
  ☆661Updated last year