Alternatives and similar repositories for SilkETW:

Users that are interested in SilkETW are comparing it to the libraries listed below

• danielbohannon / Revoke-Obfuscation
  PowerShell Obfuscation Detection Framework
  ☆730Updated last year
• R3MRUM / PSDecode
  PowerShell script for deobfuscating encoded PowerShell scripts
  ☆424Updated 4 years ago
• mandiant / DueDLLigence
  ☆468Updated last year
• zodiacon / EtwExplorer
  View ETW Provider manifest
  ☆461Updated 4 months ago
• bats3c / Ghost-In-The-Logs
  Evade sysmon and windows event logging
  ☆615Updated 4 years ago
• marcosd4h / memhunter
  Live hunting of code injection techniques
  ☆379Updated 5 years ago
• danielbohannon / Invoke-CradleCrafter
  PowerShell Remote Download Cradle Generator & Obfuscator
  ☆828Updated 6 years ago
• mvelazc0 / PurpleSharp
  PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monit…
  ☆794Updated 2 months ago
• commial / experiments
  Expriments
  ☆452Updated 5 months ago
• leechristensen / UnmanagedPowerShell
  Executes PowerShell from an unmanaged process
  ☆483Updated 8 years ago
• mandiant / flare-wmi
  ☆426Updated last year
• DissectMalware / XLMMacroDeobfuscator
  Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
  ☆576Updated 10 months ago
• D4stiny / PeaceMaker
  PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.
  ☆419Updated 4 years ago
• jdu2600 / Windows10EtwEvents
  Events from all manifest-based and mof-based ETW providers across Windows 10 versions
  ☆286Updated 10 months ago
• outflanknl / Dumpert
  LSASS memory dumper using direct system calls and API unhooking.
  ☆1,516Updated 4 years ago
• 3lp4tr0n / BeaconHunter
  Detect and respond to Cobalt Strike beacons using ETW.
  ☆487Updated 2 years ago
• JPCERTCC / ToolAnalysisResultSheet
  Tool Analysis Result Sheet
  ☆347Updated 7 years ago
• Mr-Un1k0d3r / EDRs
  ☆2,058Updated 2 years ago
• jthuraisamy / TelemetrySourcerer
  Enumerate and disable common sources of telemetry used by AV/EDR.
  ☆782Updated 4 years ago
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆732Updated 11 months ago
• nasbench / EVTX-ETW-Resources
  Event Tracing For Windows (ETW) Resources
  ☆362Updated 5 months ago
• hatRiot / token-priv
  Token Privilege Research
  ☆807Updated 7 years ago
• MHaggis / sysmon-dfir
  Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
  ☆911Updated last year
• CCob / SharpBlock
  A method of bypassing EDR's active projection DLL's by preventing entry point exection
  ☆1,134Updated 3 years ago
• Cybereason / siofra
  ☆479Updated 7 years ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆290Updated last month
• sbousseaden / Slides
  Misc Threat Hunting Resources
  ☆373Updated 2 years ago
• JPCERTCC / SysmonSearch
  Investigate suspicious activity by visualizing Sysmon's event log
  ☆421Updated last year
• mandiant / SharPersist
  ☆1,446Updated last year
• rasta-mouse / TikiTorch
  Process Injection
  ☆758Updated 3 years ago