jsecurity101 / ETWInspector

Related projects: ⓘ

• jsecurity101 / JonMon
  ☆154Updated last month
• pathtofile / SealighterTI
  Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider
  ☆157Updated last year
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆105Updated 2 months ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆200Updated 3 months ago
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆239Updated last year
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆170Updated last year
• FuzzySecurity / BHUSA-2023
  ☆102Updated 2 months ago
• rad9800 / hwbp4mw
  ☆206Updated last year
• bohops / RogueAssemblyHunter
  Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
  ☆114Updated 2 years ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆64Updated 2 weeks ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆92Updated 5 months ago
• CCob / Shwmae
  ☆115Updated 2 weeks ago
• Kudaes / Bin-Finder
  Detect EDR's exceptions by inspecting processes' loaded modules
  ☆120Updated 6 months ago
• airbus-cert / vbSparkle
  VBScript & VBA source-to-source deobfuscator with partial-evaluation
  ☆72Updated last month
• nccgroup / DetectWindowsCopyOnWriteForAPI
  Enumerate various traits from Windows processes as an aid to threat hunting
  ☆180Updated 2 years ago
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆272Updated last month
• 0x534a / dynmx
  Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!
  ☆80Updated last year
• xalicex / Killers
  Exploitation of process killer drivers
  ☆182Updated 11 months ago
• struppigel / hedgehog-tools
  ☆103Updated last month
• HackingLZ / ExtractedDefender
  ☆204Updated 2 years ago
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆77Updated last year
• mattifestation / AntimalwareBlight
  Execute PowerShell code at the antimalware-light protection level.
  ☆135Updated last year
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆131Updated 8 months ago
• pmatula / Windows-Internals-Learning-Resources
  ☆93Updated last week
• joe-desimone / rep-research
  ☆62Updated last month
• nasbench / Misc-Research
  A collection of tools, scripts and personal research
  ☆104Updated 2 months ago
• dsnezhkov / shutter
  ☆105Updated 3 years ago
• sensepost / mydumbedr
  ☆98Updated 7 months ago
• mansk1es / GhostFart
  ☆132Updated last year
• jstrosch / sclauncher
  A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …
  ☆121Updated last month