ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆41Updated 9 months ago
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- ☆74Updated 2 years ago
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆83Updated last year
- Small tool to play with IOCs caused by Imageload events☆42Updated 2 years ago
- Finding secrets in kernel and user memory☆116Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- ☆45Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆89Updated 2 years ago
- Detect WFP filters blocking EDR communications☆93Updated last year
- Red Team Operation's Defense Evasion Technique.☆53Updated last year
- ☆78Updated last year
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆62Updated last year
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆57Updated last year
- ☆67Updated 2 years ago
- .NET tool used to enrich RPC telemetry☆87Updated last month
- Golang bindings for PE-sieve☆42Updated last year
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆50Updated last year
- ☆76Updated 11 months ago
- A proof-of-concept created for academic/learning purposes, demonstrating both local and remote use of VSTO "Add-In's" maliciously☆31Updated 2 years ago
- Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke u…☆54Updated 3 years ago
- ☆59Updated last year
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆64Updated 3 years ago
- A PoC for achieving persistence via push notifications on Windows☆46Updated 2 years ago
- Do some DLL SideLoading magic☆84Updated last year
- ☆107Updated 2 years ago
- Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2☆41Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆38Updated last year
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆89Updated last year
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆100Updated last year
- Quickly search for references to a GUID in DLLs, EXEs, and drivers☆74Updated 3 years ago