Alternatives and similar repositories for ETWInspector:

Users that are interested in ETWInspector are comparing it to the libraries listed below

• pathtofile / SealighterTI
  Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider
  ☆171Updated 2 years ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆116Updated 9 months ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆154Updated 4 months ago
• olafhartong / PockETWatcher
  a tiny program to consume from ETW providers for research
  ☆47Updated 4 months ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆78Updated 8 months ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆154Updated 5 months ago
• OtterHacker / Hooker
  ☆105Updated 6 months ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆98Updated last year
• jdu2600 / Get-InjectedThreadEx
  Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
  ☆40Updated last year
• Kudaes / Bin-Finder
  Detect EDR's exceptions by inspecting processes' loaded modules
  ☆129Updated last year
• daem0nc0re / SharpWnfSuite
  C# Utilities for Windows Notification Facility
  ☆150Updated 3 weeks ago
• eversinc33 / PSXecute
  MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.
  ☆114Updated 5 months ago
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆186Updated 2 years ago
• jsecurity101 / JonMon
  ☆221Updated 3 months ago
• airbus-cert / minusone
  Powershell Linter
  ☆50Updated last week
• joe-desimone / rep-research
  ☆74Updated 9 months ago
• bohops / RogueAssemblyHunter
  Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
  ☆117Updated 3 years ago
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆163Updated last month
• patrickmatula / Windows-Internals-Learning-Resources
  ☆100Updated 5 months ago
• volexity / GoResolver
  GoResolver is a Go analysis tool using both Go symbol extraction and Control Flow Graph (CFG) similarity to identify and resolve the func…
  ☆46Updated last week
• ignacioj / WhacAMole
  Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and en…
  ☆40Updated 7 months ago
• xforcered / Being-A-Good-CLR-Host
  ☆105Updated 3 months ago
• HackingLZ / ExtractedDefender
  ☆216Updated 2 years ago
• amjcyber / EDRNoiseMaker
  Detect WFP filters blocking EDR communications
  ☆86Updated last year
• mattifestation / AntimalwareBlight
  Execute PowerShell code at the antimalware-light protection level.
  ☆141Updated 2 years ago
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆311Updated last year
• mansk1es / GhostFart
  ☆136Updated last year
• reecdeep / hollowise
  Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis …
  ☆36Updated 2 months ago
• codewhitesec / SysmonEnte
  ☆75Updated 2 years ago
• jsecurity101 / PowerParse
  PowerShell PE Parser
  ☆62Updated 10 months ago