Alternatives and similar repositories for WMIProcessWatcher

Users that are interested in WMIProcessWatcher are comparing it to the libraries listed below

• hackerhouse-opensource / Artillery
  CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administr…
  ☆183Updated last year
• OtterHacker / Hooker
  ☆108Updated last year
• sensepost / mydumbedr
  ☆120Updated last year
• BeetleChunks / Obligato
  This project is an implant framework designed for long term persistent access to Windows machines.
  ☆110Updated 2 years ago
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆139Updated last year
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆138Updated last year
• ArtemBaranov / WindowsRootkitsGuide
  ☆71Updated 9 months ago
• MalwareTech / HiddenDesktop
  Create and enumerate hidden desktops.
  ☆88Updated last year
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆50Updated last year
• hackerhouse-opensource / OffensiveLua
  Offensive Lua.
  ☆214Updated last week
• SafeBreach-Labs / wd-pretender
  ☆132Updated 2 years ago
• dr4k0nia / tooling-playground
  A collection of small scripts and tools for deobfuscation and malware analysis.
  ☆66Updated 2 years ago
• Offensive-Panda / DV_NEW
  This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)
  ☆51Updated last year
• ghostpepper108 / Evasion
  ☆107Updated 2 years ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆159Updated 11 months ago
• Z4kSec / IoctlHunter
  IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.
  ☆104Updated last year
• daddycocoaman / dumpscan
  Finding secrets in kernel and user memory
  ☆116Updated 2 years ago
• FuzzySecurity / BHUSA-2023
  ☆105Updated last year
• floesen / EventLogCrasher
  ☆192Updated last year
• patrickmatula / Windows-Internals-Learning-Resources
  ☆111Updated 11 months ago
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆318Updated 2 years ago
• dsnezhkov / shutter
  ☆122Updated 4 years ago
• georgesotiriadis / MalwareDev
  ☆84Updated 3 years ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆91Updated last year
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆202Updated 9 months ago
• eversinc33 / TriageMCP
  Vibe Malware Triage - MCP server for static PE analysis.
  ☆72Updated 6 months ago
• Karkas66 / CelestialSpark
  Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …
  ☆101Updated 7 months ago
• gatariee / Winton
  Command and Control (C2) framework
  ☆132Updated 6 months ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆162Updated 11 months ago
• reecdeep / hollowise
  Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis …
  ☆39Updated 9 months ago