Alternatives and similar repositories for cWMI:

Users that are interested in cWMI are comparing it to the libraries listed below

• roo7cause / Ps1jacker
  Ps1jacker is a tool for generating COM Hijacking payload.
  ☆61Updated last week
• matthewdunwoody / POSHSPY
  POSHSPY backdoor code
  ☆43Updated 7 years ago
• airbus-cert / PSTrace
  Trace ScriptBlock execution for powershell v2
  ☆40Updated 5 years ago
• darkquasar / WMI_Persistence
  A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics
  ☆85Updated 7 years ago
• jackson5sec / ShimDB
  Shim database persistence (Fin7 TTP)
  ☆37Updated 4 years ago
• mandiant / apooxml
  Generate YARA rules for OOXML documents.
  ☆38Updated last year
• OmerYa / Babel-Shellfish
  Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.
  ☆42Updated 6 years ago
• v1ado / HIPS_LIPS
  Community maintained list of most popular HIPS service and process names on a Windows Platform.
  ☆43Updated 2 years ago
• FuzzySecurity / BH-Arsenal-2019
  SilkETW & SilkService
  ☆40Updated 5 years ago
• psmitty7373 / eif
  Evil Reflective DLL Injection Finder
  ☆46Updated 6 years ago
• williballenthin / python-sdb
  Pure Python parser for Application Compatibility Shim Databases (.sdb files)
  ☆108Updated 4 years ago
• antman1p / SharpProcEnum
  .NET tool for enumeration processes and dumping memory.
  ☆56Updated 5 years ago
• ohjeongwook / PowerShellRunBox
  Dynamic PowerShell Analysis Framework Based Upon PowerShell Debugging Functionality
  ☆83Updated 2 years ago
• vysecurity / Invoke-ProcessScan
  Gives context to a system. Uses EQGRP shadow broker leaked list to give some descriptions to processes.
  ☆42Updated 7 years ago
• redcanaryco / wwhf
  Exercises for C# Workshop at Wild West Hackin' Fest 2018 & 2019.
  ☆64Updated 5 years ago
• FSecureLABS / SharpGPO-RemoteAccessPolicies
  A C# tool for enumerating remote access policies through group policy.
  ☆72Updated 5 years ago
• kmkz / Sources
  Random source codes
  ☆25Updated 4 years ago
• mnemonic-no / dnscache
  Volatility memory forensics plugin for extracting Windows DNS Cache
  ☆29Updated 7 years ago
• tasox / LogRM
  LogRM is a post exploitation powershell script which it uses windows event logs to gather information about internal network
  ☆73Updated 5 years ago
• jaredhaight / ReflectCmd
  A simple reflective dll example
  ☆19Updated 8 years ago
• nccgroup / WindowsMemPageDelta
  A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
  ☆31Updated 4 years ago
• davehardy20 / PoSHBypass
  ☆25Updated 6 years ago
• eset / volatility-browserhooks
  Volatility Framework plugin to detect various types of hooks as performed by banking Trojans
  ☆40Updated 6 years ago
• vletoux / DetectPasswordViaNTLMInFlow
  Extract the password of the current user from flow (keylogger, config file, ..) Use SSPI to get a valid NTLM challenge/response and test …
  ☆58Updated 5 years ago
• stvemillertime / ConventionEngine
  ConventionEngine - A Yara Rulepack for PDB Path Hunting
  ☆38Updated last year
• DimopoulosElias / SimpleMimikatzObfuscator
  A set of commands to bypass Defender (and some other AVs)
  ☆20Updated 5 years ago
• evild3ad / isodump
  isodump - ISO dump utility
  ☆40Updated 5 years ago
• 3gstudent / bitsadminexec
  Use bitsadmin to maintain persistence and bypass Autoruns
  ☆66Updated 7 years ago
• aaronst / talks
  Presentation materials for talks I've given.
  ☆20Updated 5 years ago
• clr2of8 / EvilClippy
  A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro…
  ☆19Updated 4 years ago