nmantani / PS-MOTWLinks
PS-MOTW: PowerShell scripts to set / show / remove MOTW (Mark of the Web)
☆47Updated last year
Alternatives and similar repositories for PS-MOTW
Users that are interested in PS-MOTW are comparing it to the libraries listed below
Sorting:
- ☆77Updated last year
- a tiny program to consume from ETW providers for research☆52Updated 9 months ago
- Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2☆46Updated 2 years ago
- A more reliable way of resolving syscall numbers in Windows☆52Updated last year
- Adaptive DLL hijacking / dynamic export forwarding - EAT preserve☆78Updated last year
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆17Updated last year
- Parse SDDL strings☆36Updated last year
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated last year
- ☆45Updated 2 years ago
- ☆108Updated last year
- EvtPsst☆55Updated 2 years ago
- Find DLLs with RWX section☆80Updated 2 years ago
- Mentally ill EtwTi parser☆66Updated 2 weeks ago
- "Service-less" driver loading☆162Updated 11 months ago
- Test AMSI Provider implementation in C#☆42Updated 10 months ago
- ACL Viewer for Windows☆132Updated 5 months ago
- Hotkey-based keylogger for Windows☆29Updated last year
- Self Delete DLL☆23Updated last year
- macOS dylib stager☆36Updated 9 months ago
- ☆31Updated 10 months ago
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆51Updated last year
- A Payload Analysis Framework☆109Updated 3 weeks ago
- Tool for playing with Windows Access Token manipulation.☆55Updated 2 years ago
- Bypasses AMSI protection through remote memory patching and parsing technique.☆50Updated 5 months ago
- Demoting PPL anti-malware services to less than a guest user☆63Updated 9 months ago
- ☆26Updated 2 years ago
- IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.☆105Updated last year
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆84Updated last year
- RunPE adapted for x64 and written in C, does not use RWX☆28Updated last year
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆105Updated last year