Alternatives and similar repositories for WMIProcessWatcher

Users that are interested in WMIProcessWatcher are comparing it to the libraries listed below

• hackerhouse-opensource / Artillery
  CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administr…
  ☆173Updated last year
• OtterHacker / Hooker
  ☆105Updated 6 months ago
• dr4k0nia / tooling-playground
  A collection of small scripts and tools for deobfuscation and malware analysis.
  ☆66Updated 2 years ago
• kleiton0x00 / Proxy-DLL-Loads
  A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
  ☆339Updated 3 months ago
• sensepost / mydumbedr
  ☆119Updated last year
• rad9800 / FileRenameJunctionsEDRDisable
  ☆154Updated 5 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆109Updated 8 months ago
• FuzzySecurity / BHUSA-2023
  ☆105Updated 10 months ago
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆141Updated 9 months ago
• patrickmatula / Windows-Internals-Learning-Resources
  ☆100Updated 5 months ago
• ArtemBaranov / WindowsRootkitsGuide
  ☆67Updated 3 months ago
• ghostpepper108 / Evasion
  ☆106Updated last year
• BeetleChunks / Obligato
  This project is an implant framework designed for long term persistent access to Windows machines.
  ☆110Updated last year
• floesen / EventLogCrasher
  ☆187Updated last year
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆311Updated last year
• jsecurity101 / ETWInspector
  ☆156Updated 2 weeks ago
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆162Updated last month
• ricardojoserf / NativeBypassCredGuard
  Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
  ☆237Updated last month
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆130Updated 8 months ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆154Updated 5 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆198Updated 3 months ago
• 0xsp-SRD / MDE_Enum
  comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reducti…
  ☆198Updated 11 months ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆78Updated 8 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆116Updated 10 months ago
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆214Updated 6 months ago
• Idov31 / Jormungandr
  Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.
  ☆228Updated last year
• gatariee / Winton
  Command and Control (C2) framework
  ☆126Updated last year
• Z4kSec / IoctlHunter
  IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.
  ☆100Updated last year
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆258Updated 10 months ago
• deepinstinct / ShimMe
  ☆141Updated 6 months ago