Alternatives and similar repositories for evtq

Users that are interested in evtq are comparing it to the libraries listed below

• Immersive-Labs-Sec / BruteRatel-DetectionTools
  A collection of Tools and Rules for decoding Brute Ratel C4 badgers
  ☆64Updated 3 years ago
• jonny-jhnson / LDAPMon
  ☆45Updated last year
• codewhitesec / SysmonEnte
  ☆74Updated 2 years ago
• postrequest / donut-rs
  Donut generator in rust.
  ☆28Updated 3 years ago
• netwrix / server-untrust-account
  A technique for Active Directory domain persistence
  ☆39Updated 2 years ago
• RemiEscourrou / PowerShellMisc
  ☆35Updated 3 years ago
• eladshamir / BadWindowsService
  An insecurely implemented and installed Windows service for emulating elevation of privileges vulnerabilities
  ☆62Updated 3 years ago
• riesha / drv-vuln-scanner
  Finds imports that could be exploited, still requires manual analysis.
  ☆29Updated 2 years ago
• ignacioj / WhacAMole
  Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and en…
  ☆42Updated last year
• skelsec / aardwolfgui
  Asynchronous RDP/VNC client for Python (GUI)
  ☆73Updated 8 months ago
• thalpius / Microsoft-Defender-for-Identity-Encrypted-Password
  ☆36Updated last year
• matterpreter / FindETWProviderImage
  Quickly search for references to a GUID in DLLs, EXEs, and drivers
  ☆75Updated 3 years ago
• netbiosX / GhostLoader
  GhostLoader - AppDomainManager - Injection - 攻壳机动队
  ☆54Updated 5 years ago
• citronneur / kerlab
  Kerberos laboratory to better understand and then detecting attack on kerberos
  ☆70Updated 4 years ago
• postrequest / safetydump
  MiniDump a process in memory with rust
  ☆36Updated 4 years ago
• djhohnstein / HookDetector
  Playing with PE's and Building Structures by Hand
  ☆22Updated 3 years ago
• xpn / WAMBam
  Tooling related to the WAM Bam - Recovering Web Tokens From Office blog post
  ☆128Updated 2 years ago
• vysecurity / OffensiveLAM
  A Large Action Model designed to operate on MacOS or Windows which interacts with common C2 interfaces such as Cobalt Strike, Havoc, or B…
  ☆26Updated last year
• xforcered / xPipe
  Cobalt Strike BOF to list Windows Pipes & return their Owners & DACL Permissions
  ☆54Updated 3 years ago
• wietze / windows-dll-env-hijacking
  Project for identifying executables and DLLs vulnerable to environment-variable based DLL hijacking.
  ☆60Updated 3 years ago
• CERTCC / privesc
  Process Monitor filter for finding privilege escalation vulnerabilities on Windows
  ☆79Updated 4 years ago
• h4wkst3r / SharPersist
  Windows Persistence Toolkit in C#
  ☆37Updated 2 years ago
• ustayready / roguerdp
  ☆35Updated 3 years ago
• mattifestation / AntimalwareBlight
  Execute PowerShell code at the antimalware-light protection level.
  ☆141Updated 2 years ago
• Octoberfest7 / Proxy_Egress_Persistence
  A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies
  ☆33Updated 3 years ago
• pracsec / AmsiScanner
  A tool for interacting with the Anti-Malware Scan Interface API for pen testing purposes.
  ☆65Updated last year
• mgeeky / msi-shenanigans
  Proof of Concept code and samples presenting emerging threat of MSI installer files.
  ☆87Updated 2 years ago
• Meckazin / HidingFromETW
  PoC for detecting and evading ETW detection of .Net Assembly.Load
  ☆21Updated 5 years ago
• thefLink / Hunt-Weird-ImageLoads
  Small tool to play with IOCs caused by Imageload events
  ☆42Updated 2 years ago
• EspressoCake / Firewall_Walker_BOF
  A BOF to interact with COM objects associated with the Windows software firewall.
  ☆107Updated 3 years ago