ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆43Updated last year
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- ☆76Updated 3 years ago
- Deleting Shadow Copies In Pure C++☆118Updated 3 years ago
- ☆79Updated last year
- ☆45Updated 2 years ago
- Detect WFP filters blocking EDR communications☆96Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆43Updated 2 years ago
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- ☆18Updated last year
- API Hammering with C++20☆49Updated 3 years ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆65Updated 2 years ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆31Updated 3 years ago
- Red Team Operation's Defense Evasion Technique.☆56Updated last year
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆87Updated last month
- ☆80Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆91Updated 3 years ago
- Repo containing my public talks☆23Updated 2 years ago
- Golang bindings for PE-sieve☆42Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆76Updated 2 years ago
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆58Updated 2 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆45Updated 2 years ago
- ☆121Updated last year
- ☆38Updated 2 years ago
- Various methods of executing shellcode☆73Updated 2 years ago
- Template-based generation of shellcode loaders☆79Updated last year
- ☆61Updated 2 years ago
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆51Updated last year
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆67Updated 2 years ago
- Identify and exploit leaked handles for local privilege escalation.☆111Updated 2 years ago
- ☆68Updated 3 years ago
- a tiny program to consume from ETW providers for research☆53Updated last year