Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) passed into AMSI during dynamic execution.
☆112Apr 20, 2021Updated 5 years ago
Alternatives and similar repositories for amsi-tracer
Users that are interested in amsi-tracer are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Shellcode Loader Utilizing ETW Events☆66Feb 26, 2025Updated last year
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆300Apr 10, 2021Updated 5 years ago
- Data and structures regarding the research done on WdFilter☆12Apr 15, 2020Updated 6 years ago
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆344Oct 12, 2026Updated 3 weeks ago
- A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow☆19Jun 26, 2025Updated last year
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.☆121Apr 8, 2023Updated 3 years ago
- PoC module to demonstrate automated lateral movement with the Havoc C2 framework.☆315Dec 9, 2023Updated 2 years ago
- DLL hijacking vulnerability scanner and PE infector tool☆20Sep 8, 2017Updated 9 years ago
- Resolve syscall numbers at runtime for all Windows versions.☆60Nov 21, 2024Updated last year
- A simple provider to analyse what gets passed into Microsoft's Anti-Malware Scan Interface☆17Jan 10, 2020Updated 6 years ago
- Callstack spoofing using a VEH because VEH all the things.☆23Mar 18, 2025Updated last year
- A framework for OAuth 2.0 device code authentication grant flow phishing☆47May 31, 2023Updated 3 years ago
- Firebase Domain Front Code☆21May 4, 2021Updated 5 years ago
- A tool to help malware analysts signature unique parts of RTF documents☆29Jan 5, 2026Updated 9 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")☆373Feb 27, 2023Updated 3 years ago
- PoCs and tools for investigation of Windows process execution techniques☆961Feb 2, 2026Updated 9 months ago
- ☆55Sep 6, 2020Updated 6 years ago
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆334Jul 20, 2024Updated 2 years ago
- Load .net assemblies from memory while having them appear to be loaded from an on-disk location.☆172May 5, 2021Updated 5 years ago
- Beacon Object File allowing creation of Beacons in different sessions.☆84May 23, 2022Updated 4 years ago
- Implant drop-in for EDR testing☆145Nov 15, 2023Updated 2 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆37Jul 27, 2021Updated 5 years ago
- Using outlook COM objects to create convincing phishing emails without the user noticing. This project is meant for internal phishing.☆157Dec 22, 2020Updated 5 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Run Processes as PPL with ELAM☆185Mar 17, 2022Updated 4 years ago
- A tool to create COM class/interface relationships in neo4j☆50Oct 12, 2022Updated 4 years ago
- ☆57Mar 26, 2025Updated last year
- OPSEC safe Kerberoasting in C#☆199Jun 14, 2022Updated 4 years ago
- Data from analysis of the custom sample from the chapter "Practical Analysis and Test"☆12Aug 1, 2020Updated 6 years ago
- Expriments☆491Oct 3, 2024Updated 2 years ago
- Managed assembly shellcode generation☆282Mar 19, 2021Updated 5 years ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆834Aug 23, 2021Updated 5 years ago
- A BOF to interact with COM objects associated with the Windows software firewall.☆114Oct 10, 2021Updated 5 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- PoC to demonstrate how CLR ETW events can be tampered.☆187Mar 26, 2020Updated 6 years ago
- Automatically create YARA rules from malicious documents.☆210May 16, 2022Updated 4 years ago
- Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which …☆446Oct 26, 2022Updated 4 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆90May 17, 2023Updated 3 years ago
- ☆165Jul 31, 2022Updated 4 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- Walking the PEB in VBA☆24Apr 6, 2020Updated 6 years ago