felixweyne / ProcessSpawnControl
Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launched processes, and gives the analyst the option to either keep the process suspended, or to resume it.
☆261Updated 3 years ago
Alternatives and similar repositories for ProcessSpawnControl:
Users that are interested in ProcessSpawnControl are comparing it to the libraries listed below
- Allows you to quickly query a Windows machine for RAM artifacts☆219Updated 4 years ago
- ☆421Updated last year
- ☆213Updated 6 years ago
- Pafish Macro is a Macro enabled Office Document to detect malware analysis systems and sandboxes. It uses evasion & detection techniques …☆281Updated 7 years ago
- Python script to decode common encoded PowerShell scripts☆216Updated 6 years ago
- Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect …☆132Updated 2 years ago
- ☆274Updated last year
- A YARA-integrated process denial framework for Windows☆397Updated 5 years ago
- Live hunting of code injection techniques☆380Updated 5 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆212Updated 5 years ago
- Miscellaneous Malware RE☆195Updated 2 years ago
- ☆134Updated 6 years ago
- FileInsight-plugins: decoding toolbox of McAfee FileInsight hex editor for malware analysis☆159Updated 2 months ago
- ☆297Updated 4 years ago
- A list of ways to execute code on Windows using legitimate Windows tools☆304Updated 5 years ago
- The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Micro…☆151Updated 4 years ago
- c2 traffic☆189Updated 2 years ago
- A modern Python-3-based alternative to RegRipper☆191Updated 2 months ago
- Reconstruct process trees from event logs☆147Updated 4 years ago
- ☆348Updated 3 years ago
- Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which …☆448Updated 2 years ago
- Lazy Office Analyzer☆119Updated 8 years ago
- Generating YARA rules based on binary code☆205Updated 3 years ago
- Sysmon Tools for PowerShell☆229Updated 6 years ago
- FCL (Fileless Command Lines) - Known command lines of fileless malicious executions☆465Updated 3 years ago
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆418Updated 4 years ago
- Documentation and supporting script sample for Windows Exploit Guard☆148Updated 3 years ago
- DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior☆271Updated 5 years ago
- Log newly created WMI consumers and processes to the Windows Application event log☆124Updated 6 years ago
- A repository that maps API calls to Sysmon Event ID's.☆117Updated 2 years ago