ignacioj / WhacAMoleLinks
Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆43Updated last year
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below
Sorting:
- ☆45Updated 2 years ago
- ☆76Updated 3 years ago
- Deleting Shadow Copies In Pure C++☆116Updated 3 years ago
- Finding secrets in kernel and user memory☆116Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆75Updated 2 years ago
- ☆77Updated last year
- ☆120Updated last year
- RDLL for Cobalt Strike beacon to silence sysmon process☆91Updated 3 years ago
- ☆107Updated 2 years ago
- Detect WFP filters blocking EDR communications☆95Updated last year
- Repo containing my public talks☆23Updated 2 years ago
- Golang bindings for PE-sieve☆42Updated 2 years ago
- Small tool to play with IOCs caused by Imageload events☆43Updated 2 years ago
- Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key.☆81Updated 3 years ago
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆86Updated last week
- ☆108Updated last year
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆65Updated 2 years ago
- Quickly search for references to a GUID in DLLs, EXEs, and drivers☆75Updated 4 years ago
- API Hammering with C++20☆49Updated 3 years ago
- Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules☆134Updated this week
- Red Team Operation's Defense Evasion Technique.☆56Updated last year
- ☆18Updated last year
- ☆80Updated last year
- A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.☆67Updated 2 years ago
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆58Updated last year
- Identify and exploit leaked handles for local privilege escalation.☆111Updated 2 years ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆31Updated 3 years ago
- It's pointy and it hurts!☆126Updated 3 years ago
- ☆68Updated 3 years ago
- Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…☆151Updated 2 weeks ago