cyberark / RPCMon

Related projects ⓘ

Alternatives and complementary repositories for RPCMon

• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆336Updated 2 years ago
• trailofbits / RpcInvestigator
  Exploring RPC interfaces on Windows
  ☆284Updated 9 months ago
• daem0nc0re / AtomicSyscall
  Tools and PoCs for Windows syscall investigation.
  ☆354Updated 6 months ago
• zeroperil / HookDump
  Security product hook detection
  ☆311Updated 3 years ago
• br-sn / CheekyBlinder
  Enumerating and removing kernel callbacks using signed vulnerable drivers
  ☆544Updated last year
• jsecurity101 / MSRPC-to-ATTACK
  A repository that maps commonly used attacks using MSRPC protocols to ATT&CK
  ☆311Updated last year
• DamonMohammadbagher / ETWProcessMon2
  ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…
  ☆292Updated 8 months ago
• xuanxuan0 / TiEtwAgent
  PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
  ☆254Updated 3 years ago
• deepinstinct / Dirty-Vanity
  A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…
  ☆621Updated last year
• rad9800 / TamperingSyscalls
  ☆461Updated 2 years ago
• rajiv2790 / FalconEye
  ☆290Updated 3 years ago
• Dec0ne / HWSyscalls
  HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.
  ☆628Updated last year
• commial / experiments
  Expriments
  ☆442Updated last month
• huntandhackett / concealed_code_execution
  Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows
  ☆199Updated 2 years ago
• LloydLabs / delete-self-poc
  A way to delete a locked file, or current running executable, on disk.
  ☆499Updated 3 months ago
• mgeeky / UnhookMe
  UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …
  ☆341Updated 2 years ago
• trustedsec / COFFLoader
  ☆471Updated 3 weeks ago
• lab52io / LeakedHandlesFinder
  Leaked Windows processes handles identification tool
  ☆272Updated 2 years ago
• hasherezade / process_overwriting
  Yet another variant of Process Hollowing
  ☆355Updated 8 months ago
• daem0nc0re / TangledWinExec
  PoCs and tools for investigation of Windows process execution techniques
  ☆882Updated this week
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆433Updated 2 weeks ago
• thefLink / Hunt-Sleeping-Beacons
  Aims to identify sleeping beacons
  ☆489Updated 5 months ago
• RedSection / OffensivePH
  OffensivePH - use old Process Hacker driver to bypass several user-mode access controls
  ☆329Updated 3 years ago
• Cracked5pider / KaynLdr
  KaynLdr is a Reflective Loader written in C/ASM
  ☆521Updated 11 months ago
• nettitude / RunPE
  C# Reflective loader for unmanaged binaries.
  ☆419Updated last year
• itm4n / PPLdump
  Dump the memory of a PPL with a userland exploit
  ☆845Updated 2 years ago
• ElliotKillick / LdrLockLiberator
  For when DLLMain is the only way
  ☆353Updated 3 weeks ago
• gabriellandau / PPLFault
  ☆506Updated 8 months ago
• APTortellini / unDefender
  Killing your preferred antimalware by abusing native symbolic links and NT paths.
  ☆351Updated 2 years ago
• trickster0 / TartarusGate
  TartarusGate, Bypassing EDRs
  ☆533Updated 2 years ago