felixweyne / ProcessSpawnControlLinks
Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launched processes, and gives the analyst the option to either keep the process suspended, or to resume it.
☆264Updated 3 years ago
Alternatives and similar repositories for ProcessSpawnControl
Users that are interested in ProcessSpawnControl are comparing it to the libraries listed below
Sorting:
- Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect …☆142Updated 3 years ago
- Allows you to quickly query a Windows machine for RAM artifacts☆219Updated 5 years ago
- ☆136Updated 6 years ago
- Live hunting of code injection techniques☆383Updated 6 years ago
- Miscellaneous Malware RE☆196Updated 3 years ago
- Pafish Macro is a Macro enabled Office Document to detect malware analysis systems and sandboxes. It uses evasion & detection techniques …☆293Updated 8 years ago
- Python script to decode common encoded PowerShell scripts☆217Updated 7 years ago
- ☆428Updated 2 years ago
- Vba2Graph - Generate call graphs from VBA code, for easier analysis of malicious documents.☆279Updated 4 years ago
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆120Updated last year
- ☆221Updated 7 years ago
- snake - a malware storage zoo☆217Updated 2 years ago
- A YARA-integrated process denial framework for Windows☆397Updated 5 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆109Updated 4 years ago
- Lazy Office Analyzer☆122Updated 8 years ago
- ☆84Updated 5 years ago
- A VBA parser and emulation engine to analyze malicious macros.☆96Updated last month
- c2 traffic☆192Updated 2 years ago
- ☆280Updated 2 years ago
- ☆348Updated 4 years ago
- Generating YARA rules based on binary code☆217Updated 4 years ago
- Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which …☆447Updated 3 years ago
- Parse evtx files and detect use of the DanderSpritz eventlogedit module☆150Updated 8 years ago
- The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Micro…☆149Updated 5 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆215Updated 6 years ago
- Reconstruct process trees from event logs☆147Updated 5 years ago
- A modern Python-3-based alternative to RegRipper☆205Updated 8 months ago
- FileInsight-plugins: decoding toolbox of McAfee FileInsight hex editor for malware analysis☆162Updated last year
- Various scripts for different malware families☆106Updated 4 years ago
- Cuckoo Sandbox plugin for extracts configuration data of known malware☆135Updated 2 years ago