ignacioj / WhacAMole
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆40Updated 7 months ago
Alternatives and similar repositories for WhacAMole:
Users that are interested in WhacAMole are comparing it to the libraries listed below
- ☆45Updated last year
- SharpShareFinder is a minimalistic network share discovery POC designed to enumerate shares in Windows Active Directory networks leveragi…☆27Updated 10 months ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆88Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated last year
- ☆76Updated 2 years ago
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆82Updated last year
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆31Updated 2 years ago
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆62Updated last year
- MITRE TTPs derived from Conti's leaked playbooks from XSS.IS☆37Updated 3 years ago
- ☆59Updated last year
- ☆17Updated 7 months ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Repo containing my public talks☆23Updated last year
- Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2☆40Updated last year
- Create a cool process tree like https://twitter.com/ACEResponder.☆35Updated 2 years ago
- malleable profile generator GUI for Havoc☆55Updated 2 years ago
- Proof of Concept code and samples presenting emerging threat of MSI installer files.☆81Updated 2 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆62Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆38Updated 9 months ago
- Default Detections for EDR☆96Updated last year
- Repository for archiving Cobalt Strike configuration☆30Updated this week
- a variety of tools,scripts and techniques developed and shared with different programming languages by 0xsp Lab☆63Updated 4 months ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- PoC-Malware-TTPs☆49Updated 2 years ago
- Slide decks and/or materials from conference presentations☆56Updated 2 years ago
- a tiny program to consume from ETW providers for research☆47Updated 4 months ago
- Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE☆65Updated 2 years ago
- Tool for playing with Windows Access Token manipulation.☆54Updated 2 years ago