matterpreter / FindETWProviderImageLinks
Quickly search for references to a GUID in DLLs, EXEs, and drivers
☆75Updated 4 years ago
Alternatives and similar repositories for FindETWProviderImage
Users that are interested in FindETWProviderImage are comparing it to the libraries listed below
Sorting:
- ☆48Updated 5 years ago
- Process Monitor filter for finding privilege escalation vulnerabilities on Windows☆79Updated 4 years ago
- Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.☆117Updated 3 years ago
- Assembly HellGate implementation that directly calls Windows System Calls and displays the PPID of the explorer.exe process☆106Updated 2 years ago
- ☆76Updated 3 years ago
- GhostLoader - AppDomainManager - Injection - 攻壳机动队☆53Updated 5 years ago
- A simple proof of concept for detecting use of Cobalt Strike's execute-assembly☆59Updated 3 years ago
- Specialized tool to dump Position Independent Code.☆22Updated 5 years ago
- PE File Blessing - To continue or not to continue☆87Updated 6 years ago
- ☆55Updated 4 years ago
- Depending on the AV/EPP/EDR creating a Taskschedule Job with a default cradle is often flagged☆88Updated 3 years ago
- Execute PowerShell code at the antimalware-light protection level.☆141Updated 3 years ago
- ☆33Updated 3 years ago
- Weaponizing CLRvoyance for Post-Ex .NET Execution☆39Updated 4 years ago
- Companion PoC for the "Adventures in Dynamic Evasion" blog post☆129Updated 4 years ago
- A BOF to interact with COM objects associated with the Windows software firewall.☆109Updated 4 years ago
- Small Python tool to do DLL Sideloading (and consequently, other DLL attacks).☆58Updated 3 years ago
- The repository that complements the From zero to hero: creating a reflective loader in C# workshop☆39Updated 4 years ago
- A collection of Tools and Rules for decoding Brute Ratel C4 badgers☆66Updated 3 years ago
- A recreation of the "Nobelium" malware based on Microsofts Malware analysis - Part 1: PDF2Pwn☆102Updated 2 years ago
- ☆53Updated 4 years ago
- DInvisibleRegistry☆82Updated 5 years ago
- ☆23Updated 4 years ago
- The repository accompanying the Buer Emulation workshop☆23Updated 4 years ago
- Code samples of .NET shellcode injections, weaponized for use via WebDav and mshta.exe.☆37Updated 5 years ago
- Tradecraft Development Fundamentals☆40Updated 4 years ago
- A module for CME that spiders across a domain.☆35Updated 3 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆91Updated 3 years ago
- A tool to create COM class/interface relationships in neo4j☆50Updated 3 years ago
- C# Implementation of Jared Atkinson's Get-InjectedThread.ps1☆53Updated 4 years ago