ETWhat is a Windows utility that determines whether Event Tracing for Windows (ETW) providers operate in kernel mode or user mode.
☆10Jun 9, 2025Updated last year
Alternatives and similar repositories for ETWhat
Users that are interested in ETWhat are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This is the Git repository for the Modern Red Teaming workshop given at SINCON2024.☆13May 23, 2024Updated 2 years ago
- This exploit is utilising AddressOfEntryPoint of process which is RX and using WriteProcessMemory internal magic to change the permission…☆20Oct 31, 2024Updated last year
- ☆24Jun 17, 2024Updated 2 years ago
- Some security by obscurity using port-jumping.☆14Jul 3, 2026Updated 3 months ago
- FJTA (Forensic Journal Timeline Analyzer) is a tool that analyzes Linux filesystem (ext4, XFS) journals (not systemd-journald logs), gene…☆113Apr 8, 2026Updated 6 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- a strictly RFC 4510 conforming LDAP V3 pure Python client. The same codebase works with Python 2. Python 3, PyPy and PyPy3☆10Apr 19, 2025Updated last year
- ☆21Sep 11, 2026Updated last month
- ☆24Sep 7, 2026Updated last month
- Run PowerShell command without invoking powershell.exe☆27Apr 9, 2026Updated 6 months ago
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆29Sep 18, 2024Updated 2 years ago
- Vault of Windows Registry forensic artifacts☆33Nov 12, 2025Updated 11 months ago
- A fast, deterministic, non-cryptographic hash for use in hash tables for Rust☆15Jan 12, 2021Updated 5 years ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆65Feb 11, 2024Updated 2 years ago
- Reverse engineering and live validation of the Windows Endpoint Security Platform preview☆17Sep 11, 2026Updated last month
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A repository of output using KAPE (!EZParser Module) for various publicly available forensic images!☆18Aug 31, 2024Updated 2 years ago
- In-memory hiding technique☆66Jan 5, 2025Updated last year
- Misery Loader to bypass modern EDR solutions☆19Dec 20, 2024Updated last year
- ☆11Jan 23, 2023Updated 3 years ago
- NSecSoftBYOVD POC☆63Feb 12, 2026Updated 8 months ago
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆40May 6, 2023Updated 3 years ago
- The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.☆58Apr 22, 2025Updated last year
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆13Jul 15, 2023Updated 3 years ago
- Maps process creation logged by Sysmon uses Google Org Chart API☆23Mar 5, 2016Updated 10 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- A C# port of https://gist.github.com/adamsvoboda/8f29e09d74b73e1dec3f9049c4358e80☆21Apr 2, 2025Updated last year
- All my POC related to malware development☆15Aug 4, 2026Updated 2 months ago
- Packet Monkey is a tool to filter and classify PCAPs using Wireshark filters☆15Sep 19, 2026Updated last month
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆15Jan 7, 2023Updated 3 years ago
- ROP gadget-based sleep obfuscation technique☆14Aug 10, 2025Updated last year
- shell code example☆69Dec 12, 2025Updated 10 months ago
- ☆40Jun 23, 2024Updated 2 years ago
- Security Related Tools and Resources☆16Aug 10, 2017Updated 9 years ago
- Scan, fuzz, and assess OT protocols from one CLI.☆33Oct 12, 2026Updated last week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Quickly search for references to a GUID in DLLs, EXEs, and drivers☆75Dec 10, 2021Updated 4 years ago
- EDR/AV Simulation for Malware Development☆12Oct 21, 2023Updated 3 years ago
- Detour hooking IRQ1 ISR through IDT (Interrupt Descriptor Table)☆21Mar 16, 2026Updated 7 months ago
- What's the Red Team doing to my Linux Box? - BSides Vienna 2024☆16Nov 23, 2024Updated last year
- User-mode ETW interception and telemetry manipulation lab for Windows security research.☆43Jun 15, 2026Updated 4 months ago
- A firebeam plugin that exploits the CVE-2024-26229 vulnerability to perform elevation of privilege from a unprivileged user☆41Aug 15, 2024Updated 2 years ago
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago