Alternatives and similar repositories for Windows10EtwEvents:

Users that are interested in Windows10EtwEvents are comparing it to the libraries listed below

• repnz / etw-providers-docs
  Document ETW providers
  ☆228Updated 5 years ago
• pathtofile / Sealighter
  Sysmon-Like research tool for ETW
  ☆354Updated 2 years ago
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆475Updated 5 months ago
• hfiref0x / WDExtract
  Extract Windows Defender database from vdm files and unpack it
  ☆439Updated 5 years ago
• commial / experiments
  Expriments
  ☆452Updated 6 months ago
• marcosd4h / sysmonx
  SysmonX - An Augmented Drop-In Replacement of Sysmon
  ☆214Updated 5 years ago
• palantir / exploitguard
  Documentation and supporting script sample for Windows Exploit Guard
  ☆156Updated 3 years ago
• cyberark / RPCMon
  RPC Monitor tool based on Event Tracing for Windows
  ☆344Updated 7 months ago
• endgameinc / ClrGuard
  ☆216Updated 7 years ago
• xuanxuan0 / TiEtwAgent
  PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
  ☆271Updated 4 years ago
• 0xAlexei / WindowsDefenderTools
  Tools for instrumenting Windows Defender's mpengine.dll
  ☆294Updated 6 years ago
• microsoft / krabsetw
  KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
  ☆648Updated last month
• marcosd4h / memhunter
  Live hunting of code injection techniques
  ☆379Updated 5 years ago
• 0xeb / WinTools
  A collection of free miscellaneous Windows tools
  ☆133Updated 7 months ago
• nasbench / EVTX-ETW-Resources
  Event Tracing For Windows (ETW) Resources
  ☆374Updated 6 months ago
• pathtofile / PPLRunner
  Run Processes as PPL with ELAM
  ☆161Updated 3 years ago
• D4stiny / PeaceMaker
  PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.
  ☆420Updated 4 years ago
• mattifestation / PIC_Bindshell
  Position Independent Windows Shellcode Written in C
  ☆290Updated 6 years ago
• 0xcpu / ExecutiveCallbackObjects
  Research on Windows Kernel Executive Callback Objects
  ☆286Updated 5 years ago
• fireeye / pywintrace
  ETW Python Library
  ☆279Updated last year
• hugsy / CFB
  Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver.
  ☆317Updated last year
• ionescu007 / HookingNirvana
  Recon 2015 Presentation from Alex Ionescu
  ☆232Updated 9 years ago
• csandker / InterProcessCommunication-Samples
  Some Code Samples for Windows based Inter-Process-Communication (IPC)
  ☆171Updated last year
• rajiv2790 / FalconEye
  ☆295Updated 3 years ago
• CylanceVulnResearch / ReflectiveDLLRefresher
  Universal Unhooking
  ☆320Updated 6 years ago
• CheckPointSW / showstopper
  ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solution…
  ☆203Updated 2 years ago
• ernw / Windows-Insight
  The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Micro…
  ☆151Updated 4 years ago
• conix-security / zer0m0n
  zer0m0n driver for cuckoo sandbox
  ☆359Updated 9 years ago
• hasherezade / module_overloading
  A more stealthy variant of "DLL hollowing"
  ☆345Updated last year
• LloydLabs / Windows-API-Hashing
  This is a simple example and explanation of obfuscating API resolution via hashing
  ☆235Updated 4 years ago