jsecurity101 / ETWInspector
☆155Updated 10 months ago
Alternatives and similar repositories for ETWInspector:
Users that are interested in ETWInspector are comparing it to the libraries listed below
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆169Updated 2 years ago
- ☆216Updated last month
- a tiny program to consume from ETW providers for research☆46Updated 2 months ago
- ☆149Updated 3 months ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆114Updated 8 months ago
- Detect EDR's exceptions by inspecting processes' loaded modules☆130Updated last year
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆76Updated 6 months ago
- Tools for analyzing EDR agents☆221Updated 9 months ago
- ☆103Updated 4 months ago
- ☆70Updated 7 months ago
- "Service-less" driver loading☆148Updated 3 months ago
- ETW based POC to identify direct and indirect syscalls☆181Updated last year
- Detect WFP filters blocking EDR communications☆85Updated last year
- Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.☆117Updated 3 years ago
- Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!☆82Updated last year
- 32bit MIPS I VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.☆111Updated 3 months ago
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆96Updated 11 months ago
- Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2☆36Updated last year
- ☆105Updated 8 months ago
- VBScript & VBA source-to-source deobfuscator with partial-evaluation☆75Updated 7 months ago
- ☆114Updated last year
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆73Updated last year
- Collect Windows telemetry for Maldev☆316Updated last month
- EDRSandblast-GodFault☆257Updated last year
- ☆96Updated 2 months ago
- A collection of various and sundry code snippets that leverage .NET dynamic tradecraft☆141Updated 10 months ago
- Powershell Linter☆50Updated this week
- Enumerate various traits from Windows processes as an aid to threat hunting☆186Updated 3 years ago
- ☆214Updated 2 years ago