ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆43Updated last year
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- Deleting Shadow Copies In Pure C++☆118Updated 3 years ago
- ☆46Updated 2 years ago
- ☆78Updated 3 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆91Updated 3 years ago
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- ☆107Updated 2 years ago
- Red Team Operation's Defense Evasion Technique.☆56Updated last year
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆88Updated last month
- Small tool to play with IOCs caused by Imageload events☆44Updated 2 years ago
- Golang bindings for PE-sieve☆42Updated 2 years ago
- API Hammering with C++20☆49Updated 3 years ago
- Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.☆82Updated 3 years ago
- A lightweight Windows Prefetch file parser to extract programs' execution history☆48Updated 2 weeks ago
- Detect WFP filters blocking EDR communications☆96Updated 2 years ago
- Reverse Engineering and Debugging Malware☆32Updated 2 years ago
- Repository for archiving Cobalt Strike configuration☆35Updated this week
- A C implementation of the Sektor7 "A Thief" Windows privesc technique.☆70Updated 3 years ago
- ☆38Updated 2 years ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆31Updated 3 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆46Updated 2 years ago
- Detect strange memory regions and DLLs☆183Updated 4 years ago
- ☆80Updated last year
- Identify and exploit leaked handles for local privilege escalation.☆111Updated 2 years ago
- ☆68Updated 3 years ago
- Project for identifying executables and DLLs vulnerable to environment-variable based DLL hijacking.☆62Updated 3 years ago
- ☆18Updated last year
- Just another ntdll unhooking using Parun's Fart technique☆76Updated 2 years ago
- EvtPsst☆55Updated 2 years ago
- Bypass Malware Time Delays☆108Updated 3 years ago
- A proof-of-concept created for academic/learning purposes, demonstrating both local and remote use of VSTO "Add-In's" maliciously☆31Updated 2 years ago