fireeye / cWMI
This project is a lightweight wrapper for interacting with WMI using python/ctypes
☆38Updated 5 years ago
Alternatives and similar repositories for cWMI:
Users that are interested in cWMI are comparing it to the libraries listed below
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆41Updated 6 years ago
- Generate YARA rules for OOXML documents.☆37Updated last year
- Ps1jacker is a tool for generating COM Hijacking payload.☆61Updated 6 years ago
- Presentation materials for talks I've given.☆20Updated 5 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago
- hopefully a source-to-source deobfuscator, aiming at deobfuscating common scripts languages such as Powershell, VBA and Javascript. Curre…☆40Updated 5 years ago
- Trace ScriptBlock execution for powershell v2☆39Updated 5 years ago
- Loads the AutoIt DLL and PowerShell assemblies into memory and executes the specified keystrokes☆61Updated 7 years ago
- windows-operating-system-archaeology @Enigma0x3 @subTee☆44Updated 7 years ago
- Generate a Yara rule to find base64-encoded files containg a specific keyword☆41Updated 6 years ago
- Shim database persistence (Fin7 TTP)☆36Updated 4 years ago
- SilkETW & SilkService☆40Updated 5 years ago
- Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research☆53Updated 6 years ago
- A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection☆30Updated 4 years ago
- Light System Examination Toolkit (LISET) - logs & activity & configuration gathering utility that comes handy in fast Windows incident re…☆27Updated 8 years ago
- Volatility memory forensics plugin for extracting Windows DNS Cache☆29Updated 7 years ago
- Code and Slides of my BSides London 2019 presentation about Attacker Emulation using CALDERA☆22Updated 5 years ago
- Python parser for Red Canary's Atomic Red Team Yamls☆27Updated 5 years ago
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆37Updated last year
- ☆108Updated 6 years ago
- ☆51Updated 6 years ago
- ☆24Updated 6 years ago
- Forked and updated with some additional features over the original☆16Updated 3 years ago
- ☆10Updated 4 years ago
- POSHSPY backdoor code☆43Updated 7 years ago
- Specialized tool to dump Position Independent Code.☆21Updated 4 years ago
- Python script to patch the reflective stub in a DLL☆24Updated 7 years ago
- Handy scripts to speed up malware analysis☆35Updated last year