Browse and diff ETW provider snapshots across Windows builds. Backed by ETWInspector.
☆39Sep 9, 2026Updated last month
Alternatives and similar repositories for EtwWatcher
Users that are interested in EtwWatcher are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Post-ex tool to interact with chromium browser when CDP is enabled☆47May 15, 2026Updated 5 months ago
- Drop any Windows DPAPI artifact and it identifies the format and the exact master key it needs, then decrypts once you supply the key. Of…☆31Sep 23, 2026Updated 3 weeks ago
- Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file…☆109Oct 11, 2026Updated last week
- File hosting and scripted web delivery service extender for AdaptixC2. Host files over HTTP/HTTPS, generate one-liner payloads across 17 …☆36Aug 24, 2026Updated last month
- ANIMO Azure Network Intel & Mission Ops a C2 based on Azure/Entra assessments☆93Sep 16, 2026Updated last month
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Extract hashes from VBK files -- cause it's fun...☆52Aug 10, 2026Updated 2 months ago
- Automated HTTP/HTTPS simulation for Cobalt Strike Malleable C2 profiles☆28Sep 3, 2026Updated last month
- Repository for various Beacon Object Files (BOFs)☆122Updated this week
- CnaEmulator is a standalone, general-purpose development, emulation, and testing harness for Cobalt Strike Aggressor Scripts (.cna)☆23Sep 20, 2026Updated 3 weeks ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 3 months ago
- Adjusted version of the impacket-dcomexec script to work against Windows 10☆19Oct 13, 2025Updated last year
- Custom Adaptix-compatible C2 agent - PIC beacon + Stardust UDRL + Go extender plugins☆144Oct 4, 2026Updated 2 weeks ago
- ☆73Sep 29, 2026Updated 2 weeks ago
- Parser and reconciliation tooling for large Active Directory environments.☆33Feb 18, 2025Updated last year
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- ☆49Oct 4, 2026Updated 2 weeks ago
- Extract PRT cookies remotely with InteractiveToken Scheduled Tasks☆34Aug 13, 2026Updated 2 months ago
- Novel lateral movement and privilege escalation tool leveraging PowerShell named pipes. Allows for executing PowerShell commands over the…☆25Oct 8, 2026Updated last week
- Gadget scanner that finds ROP gadgets inside any Windows DLL☆47Jun 18, 2026Updated 4 months ago
- A BOF designed to inspect processes memory and addresses☆41Apr 19, 2026Updated 5 months ago
- A Go library to create BloodHound OpenGraphs easily☆15Jun 18, 2026Updated 4 months ago
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆69Sep 17, 2026Updated last month
- Malware as a Service Ludus Range☆129Sep 24, 2026Updated 3 weeks ago
- Powershell & Javascript Obfuscator☆49Aug 24, 2026Updated last month
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Recover NT hashes from NetNTLMv1 responses using local WebGPU computation and local/remote table lookup☆136Oct 7, 2026Updated last week
- Token Analysis and Tracking System☆45Aug 25, 2026Updated last month
- Windows native ETW inspection suite for browsing providers, reading metadata, consuming live events, recording ETL traces, filtering resu…☆113Oct 2, 2026Updated 2 weeks ago
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 2 months ago
- SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.☆41Aug 3, 2026Updated 2 months ago
- Evasion kit for Cobalt Strike☆17Aug 13, 2026Updated 2 months ago
- Blacklight is a cross-platform toolkit for mapping, analyzing, and understanding the local AI agent attack surface across Windows, macOS,…☆88Updated this week
- Cobalt Strike notifications via NTFY.☆15Sep 24, 2024Updated 2 years ago
- Attack techniques for threat emulation in VMware environments☆55Aug 25, 2026Updated last month
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆151Sep 27, 2026Updated 3 weeks ago
- Undetectable offensive toolkit inside Chrome☆146Aug 27, 2026Updated last month
- ☆83Sep 21, 2026Updated 3 weeks ago
- OneDrive as a covert C2 transport for Cobalt Strike☆77Sep 19, 2026Updated 3 weeks ago
- EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra…☆122Updated this week
- A vibe-coded port of wiretap☆37Apr 25, 2026Updated 5 months ago
- Ask the Web Account Manager (WAM) for Entra ID tokens☆162Sep 11, 2026Updated last month