ignacioj / WhacAMole
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆33Updated 3 months ago
Alternatives and similar repositories for WhacAMole:
Users that are interested in WhacAMole are comparing it to the libraries listed below
- ☆45Updated last year
- SharpShareFinder is a minimalistic network share discovery POC designed to enumerate shares in Windows Active Directory networks leveragi…☆25Updated 6 months ago
- ☆71Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated last year
- Copy the properties and groups of a user from neo4j (bloodhound) to create an identical golden ticket.☆83Updated 8 months ago
- Simple PowerShell script to enable process scanning with Yara.☆91Updated 2 years ago
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆62Updated 2 years ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆30Updated 2 years ago
- a tiny program to consume from ETW providers for research☆45Updated 2 weeks ago
- Unchain AMSI by patching the provider’s unmonitored memory space☆88Updated 2 years ago
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆58Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆87Updated 2 years ago
- ☆22Updated last year
- Proof of Concept code and samples presenting emerging threat of MSI installer files.☆78Updated 2 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆86Updated 2 years ago
- BasicEventViewer4 (BEV v4.0), this code will useful for All Blue/Purple Teams , RealTime Monitoring Sysmon Events , Mitre Attack Detectio…☆17Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Repo containing my public talks☆22Updated last year
- ☆68Updated 5 months ago
- Grab NetNTLMv2 hashes using ETW with administrative rights on Windows 8.1 / Windows Server 2016 and later☆91Updated last year
- Browse Windows Prefetch versions: 17,23,26,30v1/2,31 & some of SuperFetch .7db/.db's☆59Updated last month
- Just another ntdll unhooking using Parun's Fart technique☆73Updated last year
- Repository for archiving Cobalt Strike configuration☆29Updated this week
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated 6 months ago
- Small Python tool to do DLL Sideloading (and consequently, other DLL attacks).☆53Updated 2 years ago
- Create a cool process tree like https://twitter.com/ACEResponder.☆34Updated last year
- Yara Rules for Modern Malware☆73Updated 10 months ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year