jsecurity101 / ETWInspector

Related projects ⓘ

Alternatives and complementary repositories for ETWInspector

• jsecurity101 / JonMon
  ☆173Updated 4 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆111Updated 4 months ago
• pathtofile / SealighterTI
  Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider
  ☆163Updated last year
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆174Updated last year
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆209Updated 5 months ago
• OtterHacker / Hooker
  ☆98Updated 3 weeks ago
• Kudaes / Bin-Finder
  Detect EDR's exceptions by inspecting processes' loaded modules
  ☆123Updated 8 months ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆95Updated 7 months ago
• struppigel / hedgehog-tools
  ☆111Updated 2 weeks ago
• pmatula / Windows-Internals-Learning-Resources
  ☆95Updated 2 months ago
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆240Updated last year
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆72Updated 2 months ago
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆62Updated this week
• bohops / RogueAssemblyHunter
  Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
  ☆115Updated 2 years ago
• joe-desimone / rep-research
  ☆68Updated 3 months ago
• mansk1es / GhostFart
  ☆133Updated last year
• sensepost / mydumbedr
  ☆105Updated 9 months ago
• rad9800 / hwbp4mw
  ☆211Updated last year
• xalicex / Killers
  Exploitation of process killer drivers
  ☆188Updated last year
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆238Updated 7 months ago
• mattifestation / AntimalwareBlight
  Execute PowerShell code at the antimalware-light protection level.
  ☆138Updated last year
• CCob / Shwmae
  ☆129Updated last month
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆92Updated this week
• RedTeamOperations / VEH-PoC
  ☆106Updated last year
• realoriginal / grimreaper
  A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls
  ☆104Updated 2 months ago
• y11en / FOLIAGE
  Experiment on reproducing Obfuscate & Sleep
  ☆139Updated 3 years ago
• airbus-cert / minusone
  Powershell Linter
  ☆46Updated 2 months ago
• FuzzySecurity / BHUSA-2023
  ☆103Updated 4 months ago
• kleiton0x00 / Proxy-DLL-Loads
  A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
  ☆325Updated 5 months ago
• nccgroup / DetectWindowsCopyOnWriteForAPI
  Enumerate various traits from Windows processes as an aid to threat hunting
  ☆183Updated 2 years ago