ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆43Updated last year
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- ☆80Updated last year
- Detect WFP filters blocking EDR communications☆94Updated last year
- Deleting Shadow Copies In Pure C++☆116Updated 3 years ago
- ☆107Updated 2 years ago
- ☆45Updated 2 years ago
- ☆74Updated 3 years ago
- ☆77Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆90Updated 3 years ago
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated 2 years ago
- API Hammering with C++20☆49Updated 3 years ago
- Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules☆132Updated this week
- ☆120Updated last year
- Reverse Engineering and Debugging Malware☆32Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago
- Red Team Operation's Defense Evasion Technique.☆55Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆63Updated 2 years ago
- ☆18Updated last year
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆86Updated 4 months ago
- ☆108Updated last year
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆58Updated last year
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆66Updated 3 years ago
- Do some DLL SideLoading magic☆89Updated 2 years ago
- Identify and exploit leaked handles for local privilege escalation.☆111Updated 2 years ago
- abusing Process Hacker driver to terminate other processes (BYOVD)☆84Updated 2 years ago
- 「⚙️」Detect which native Windows API's (NtAPI) are being hooked☆38Updated 11 months ago
- a tiny program to consume from ETW providers for research☆53Updated 10 months ago
- Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.☆80Updated 3 years ago
- This repo will contain the core detection, only for Cobaltstrike's leaked versions. Non-leaked version detections wont be shared☆88Updated 2 years ago
- ☆119Updated 2 years ago