microsoft / SysinternalsEBPF
The Linux port of the Sysinternals Sysmon tool.
☆260Updated 3 weeks ago
Alternatives and similar repositories for SysinternalsEBPF:
Users that are interested in SysinternalsEBPF are comparing it to the libraries listed below
- Red Canary's eBPF Sensor☆103Updated 9 months ago
- Windows Registry Knowledge Base☆173Updated 6 months ago
- Library and tools to access the Windows XML Event Log (EVTX) format☆199Updated 6 months ago
- Sysmon for Linux☆1,862Updated 3 weeks ago
- convert ELF/DWARF symbol and type information into vol3's intermediate JSON☆117Updated 6 months ago
- Anything Sysmon related from the MSTIC R&D team☆152Updated 10 months ago
- A wireshark plugin to instrument ETW☆555Updated 3 years ago
- View ETW Provider manifest☆475Updated 5 months ago
- Linux Kernel Runtime Integrity with eBPF☆174Updated last year
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆293Updated 11 months ago
- Event Tracing For Windows (ETW) Resources☆374Updated 6 months ago
- This repository contains the demo material built on top of ebpf-for-windows platform.☆40Updated 7 months ago
- Linpmem is a linux memory acquisition tool☆82Updated 11 months ago
- Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA.☆246Updated 2 years ago
- VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF☆156Updated 7 months ago
- Detection in the form of Yara, Snort and ClamAV signatures.☆223Updated 5 months ago
- The common parts of the Sysinternals Sysmon tool shared between the Windows and Linux versions.☆63Updated 3 months ago
- capemon: CAPE's monitor☆115Updated this week
- ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits☆129Updated 2 years ago
- ETW Python Library☆279Updated last year
- Regipy is an os independent python library for parsing offline registry hives☆254Updated this week
- ☆86Updated 9 months ago
- Security testing tools for Windows sandboxing technologies☆165Updated last year
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆214Updated 5 years ago
- $MFT directory tree reconstruction & FILE record info☆304Updated 6 months ago
- Sysmon EDR POC Build within Powershell to prove ability.☆224Updated 3 years ago
- ☆241Updated 11 months ago
- Standard collection of rules for capa: the tool for enumerating the capabilities of programs☆573Updated 3 weeks ago
- Signature engine for all your logs☆167Updated last year
- Lnk Explorer Command line edition!!☆299Updated 3 months ago