ETWhat is a Windows utility that determines whether Event Tracing for Windows (ETW) providers operate in kernel mode or user mode.
☆10Jun 9, 2025Updated last year
Alternatives and similar repositories for ETWhat
Users that are interested in ETWhat are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This is the Git repository for the Modern Red Teaming workshop given at SINCON2024.☆13May 23, 2024Updated 2 years ago
- User-mode ETW interception and telemetry manipulation lab for Windows security research.☆42Oct 22, 2026Updated 3 weeks ago
- ☆13Sep 10, 2025Updated last year
- This exploit is utilising AddressOfEntryPoint of process which is RX and using WriteProcessMemory internal magic to change the permission…☆20Oct 31, 2024Updated 2 years ago
- Some security by obscurity using port-jumping.☆14Jul 3, 2026Updated 4 months ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), gene…☆114Apr 8, 2026Updated 7 months ago
- a strictly RFC 4510 conforming LDAP V3 pure Python client. The same codebase works with Python 2. Python 3, PyPy and PyPy3☆10Apr 19, 2025Updated last year
- ☆24Sep 7, 2026Updated 2 months ago
- Run PowerShell command without invoking powershell.exe☆27Apr 9, 2026Updated 7 months ago
- USB Monitor is a simple C# program that uses WMI to track information about newly connected and disconnected USB devices☆23Dec 16, 2023Updated 2 years ago
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆29Sep 18, 2024Updated 2 years ago
- Vault of Windows Registry forensic artifacts☆33Nov 12, 2025Updated last year
- A fast, deterministic, non-cryptographic hash for use in hash tables for Rust☆15Jan 12, 2021Updated 5 years ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆66Feb 11, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- dump of artwork, logos, and other images related to the hacker's choice <thc.org> @hackerschoice, a security research group founded in 19…☆14Jun 15, 2026Updated 4 months ago
- In-memory hiding technique☆66Jan 5, 2025Updated last year
- Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.☆33Updated this week
- Misery Loader to bypass modern EDR solutions☆19Dec 20, 2024Updated last year
- ☆11Jan 23, 2023Updated 3 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆13Jul 15, 2023Updated 3 years ago
- The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.☆58Apr 22, 2025Updated last year
- NSecSoftBYOVD POC☆63Feb 12, 2026Updated 9 months ago
- A repository of output using KAPE (!EZParser Module) for various publicly available forensic images!☆18Aug 31, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆41May 6, 2023Updated 3 years ago
- Packet Monkey is a tool to filter and classify PCAPs using Wireshark filters☆15Sep 19, 2026Updated last month
- Maps process creation logged by Sysmon uses Google Org Chart API☆23Mar 5, 2016Updated 10 years ago
- ROP gadget-based sleep obfuscation technique☆15Aug 10, 2025Updated last year
- shell code example☆69Dec 12, 2025Updated 11 months ago
- ☆40Jun 23, 2024Updated 2 years ago
- EDR/AV Simulation for Malware Development☆12Oct 21, 2023Updated 3 years ago
- Quickly search for references to a GUID in DLLs, EXEs, and drivers☆75Dec 10, 2021Updated 4 years ago
- Detour hooking IRQ1 ISR through IDT (Interrupt Descriptor Table)☆21Mar 16, 2026Updated 7 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- All my POC related to malware development☆15Aug 4, 2026Updated 3 months ago
- What's the Red Team doing to my Linux Box? - BSides Vienna 2024☆16Nov 23, 2024Updated last year
- A C# port of https://gist.github.com/adamsvoboda/8f29e09d74b73e1dec3f9049c4358e80☆21Apr 2, 2025Updated last year
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆15Jan 7, 2023Updated 3 years ago
- Security Related Tools and Resources☆16Aug 10, 2017Updated 9 years ago
- Grab Firefox post requests by hooking PR_Write function from nss3.dll module using trampoline hook to get passwords and emails of users☆41Oct 5, 2022Updated 4 years ago
Are these results useful?