ETW Python Library
☆292Aug 11, 2023Updated 2 years ago
Alternatives and similar repositories for pywintrace
Users that are interested in pywintrace are comparing it to the libraries listed below
Sorting:
- KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.☆753Dec 15, 2025Updated 2 months ago
- View ETW Provider manifest☆574Nov 1, 2024Updated last year
- Event Trace Log file parser in pure Python☆150Nov 27, 2020Updated 5 years ago
- ☆825Jun 1, 2023Updated 2 years ago
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆329May 2, 2024Updated last year
- rVMI - A New Paradigm For Full System Analysis☆359Oct 4, 2017Updated 8 years ago
- ☆220Apr 2, 2018Updated 7 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆819Mar 11, 2021Updated 4 years ago
- Sysmon-Like research tool for ETW☆386Nov 15, 2022Updated 3 years ago
- Live hunting of code injection techniques☆385Aug 22, 2019Updated 6 years ago
- ☆52Sep 17, 2018Updated 7 years ago
- Set of tools to analyze Windows sandboxes for exposed attack surface.☆2,267Nov 6, 2025Updated 3 months ago
- RedSails is a Python based post-exploitation project aimed at bypassing host based security monitoring and logging. DerbyCon 2017 Talk: h…☆307Oct 18, 2017Updated 8 years ago
- Silencing Sysmon via driver unload☆235Oct 13, 2022Updated 3 years ago
- Windows kernel and user mode emulation.☆1,860Updated this week
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆146Feb 23, 2019Updated 7 years ago
- [ARCHIVED] mov rax, ${Thalium/IceBox}; jmp rax;☆76Jun 8, 2019Updated 6 years ago
- Utilities for Sysmon☆1,573Sep 21, 2025Updated 5 months ago
- Signature engine for all your logs☆172Nov 13, 2023Updated 2 years ago
- ☆432May 3, 2023Updated 2 years ago
- An IDA plugin to deal with Event Tracing for Windows (ETW)☆55Jul 8, 2022Updated 3 years ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆301Apr 10, 2021Updated 4 years ago
- Command-line Interface for Binar.ly☆39Jan 13, 2017Updated 9 years ago
- A YARA-integrated process denial framework for Windows☆398Feb 15, 2020Updated 6 years ago
- Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-mem…☆3,562Oct 31, 2025Updated 4 months ago
- Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect …☆142Sep 29, 2022Updated 3 years ago
- Automated, Collection, and Enrichment Platform☆324Nov 14, 2019Updated 6 years ago
- WinAppDbg Debugger☆480Nov 6, 2025Updated 3 months ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆319Mar 20, 2024Updated last year
- Syscall Monitor is a system monitor program (like Sysinternal's Process Monitor) using Intel VT-X/EPT for Windows7+☆747Jun 26, 2017Updated 8 years ago
- ☆24Aug 30, 2019Updated 6 years ago
- ☆987Jan 16, 2026Updated last month
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆216Sep 17, 2019Updated 6 years ago
- AllMemPro☆46Jan 15, 2018Updated 8 years ago
- WinDBG Anti-RootKit Extension☆645Jul 29, 2020Updated 5 years ago
- Document ETW providers☆272Mar 28, 2020Updated 5 years ago
- Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.☆937Dec 12, 2023Updated 2 years ago
- LSASS memory dumper using direct system calls and API unhooking.☆1,576Jan 5, 2021Updated 5 years ago
- Pazuzu: Reflective DLL to run binaries from memory☆215Aug 4, 2020Updated 5 years ago