ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆44Updated last year
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- ☆46Updated 2 years ago
- ☆107Updated 2 years ago
- Deleting Shadow Copies In Pure C++☆118Updated 3 years ago
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- ☆78Updated 3 years ago
- ☆79Updated last year
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆89Updated 2 months ago
- Red Team Operation's Defense Evasion Technique.☆56Updated last year
- Small tool to play with IOCs caused by Imageload events☆44Updated 2 years ago
- ☆80Updated last year
- Detect WFP filters blocking EDR communications☆96Updated 2 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆92Updated 3 years ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆31Updated 3 years ago
- A lightweight Windows Prefetch file parser to extract programs' execution history☆62Updated 3 weeks ago
- ☆120Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆76Updated 2 years ago
- Golang bindings for PE-sieve☆42Updated 2 years ago
- API Hammering with C++20☆50Updated 3 years ago
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆59Updated 2 years ago
- Reverse Engineering and Debugging Malware☆32Updated 2 years ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆65Updated 2 years ago
- Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.☆82Updated last week
- ☆108Updated last year
- Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE☆66Updated 2 years ago
- a tiny program to consume from ETW providers for research☆54Updated last year
- malleable profile generator GUI for Havoc☆55Updated 2 years ago
- Get-PDInvokeImports is tool (PowerShell module) which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke u…☆54Updated 3 years ago
- ☆70Updated 2 years ago
- Repo containing my public talks☆23Updated 2 years ago
- Bypass Malware Time Delays☆108Updated 3 years ago