fireeye / cWMI
This project is a lightweight wrapper for interacting with WMI using python/ctypes
☆37Updated 5 years ago
Related projects ⓘ
Alternatives and complementary repositories for cWMI
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆41Updated 6 years ago
- Ps1jacker is a tool for generating COM Hijacking payload.☆61Updated 6 years ago
- SilkETW & SilkService☆39Updated 5 years ago
- .NET tool for enumeration processes and dumping memory.☆56Updated 5 years ago
- Shim database persistence (Fin7 TTP)☆36Updated 4 years ago
- Loads the AutoIt DLL and PowerShell assemblies into memory and executes the specified keystrokes☆60Updated 7 years ago
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆37Updated last year
- Telsy CTI Research Team☆57Updated 3 years ago
- ☆24Updated 6 years ago
- A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes…☆42Updated 3 years ago
- ☆10Updated 4 years ago
- Tool to decompress data from Windows 10 page files and memory dumps, that has been compressed by the Windows 10 memory manager.☆48Updated 5 years ago
- ReaCOM has got a lot of tools to use and is related to component object model☆73Updated 4 years ago
- A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection☆28Updated 4 years ago
- Tool for injecting a "TCP Relay" managed assembly into an unmanaged process☆63Updated 5 years ago
- Rekall Forensics and Incident Response Framework with rVMI extensions☆33Updated 3 years ago
- hopefully a source-to-source deobfuscator, aiming at deobfuscating common scripts languages such as Powershell, VBA and Javascript. Curre…☆40Updated 5 years ago
- Visual Studio Code Microsoft Sysinternal Sysmon configuration file extension.☆51Updated last year
- ☆60Updated 4 years ago
- Memory searching utilities☆42Updated 11 years ago
- Specialized tool to dump Position Independent Code.☆21Updated 4 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago
- Trace ScriptBlock execution for powershell v2☆39Updated 4 years ago
- A C# DLL to Dump LSA Secrets☆56Updated 6 years ago
- Python script to patch the reflective stub in a DLL☆24Updated 7 years ago
- Parsing MITRE EDR Evaluation results☆12Updated 5 years ago
- Cobalt Strike Field Manual - A quick reference for Windows commands that can be accessed in a beacon console.☆64Updated 6 years ago