jsecurity101 / MSFT_DriverBlockList
Repository of Microsoft Driver Block Lists based off of OS-builds
☆39Updated 7 months ago
Related projects ⓘ
Alternatives and complementary repositories for MSFT_DriverBlockList
- Small tool to play with IOCs caused by Imageload events☆37Updated last year
- ☆27Updated 4 months ago
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆14Updated 4 months ago
- API Hammering with C++20☆34Updated 2 years ago
- ☆25Updated last month
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆24Updated last year
- Self Delete DLL☆23Updated 9 months ago
- Piece of code to detect and remove hooks in IAT☆58Updated 2 years ago
- ☆10Updated 7 months ago
- ☆27Updated last year
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits☆28Updated 2 years ago
- RunPE adapted for x64 and written in C, does not use RWX☆24Updated 6 months ago
- ☆24Updated 11 months ago
- Reimplementation of the KExecDD DSE bypass technique.☆42Updated 2 months ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated last year
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆32Updated last year
- Research of modifying exported function names at runtime (C/C++, Windows)☆16Updated 5 months ago
- In-memory hiding technique☆42Updated 5 months ago
- List the ETW provider(s) in the registration table of a process.☆52Updated last year
- Research into removing strings & API call references at compile-time (Anti-Analysis)☆24Updated 5 months ago
- ☆12Updated 2 years ago
- Process Injection: APC Injection☆27Updated 3 years ago
- ☆44Updated last year
- ☆27Updated 2 years ago
- Manually perform syscalls without going through any external API or DLL.☆17Updated last year
- A simple Linux in-memory .so loader☆26Updated last year