a tiny program to consume from ETW providers for research
☆55Jan 4, 2025Updated last year
Alternatives and similar repositories for PockETWatcher
Users that are interested in PockETWatcher are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Browse and diff ETW provider snapshots across Windows builds. Backed by ETWInspector.☆40Sep 9, 2026Updated last month
- A proof-of-concept re-assembler for reverse VNC traffic.☆24May 21, 2023Updated 3 years ago
- ☆33Feb 26, 2022Updated 4 years ago
- ☆212May 10, 2026Updated 5 months ago
- Test AMSI Provider implementation in C#☆45Dec 18, 2024Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A post-processing script for TinyTracer☆40Mar 22, 2023Updated 3 years ago
- Quickly search for references to a GUID in DLLs, EXEs, and drivers☆75Dec 10, 2021Updated 4 years ago
- A public repository of MITRE ATT&ACK TTP mappings by BushidoUK for OSINT reports that lack a section breaking down the TTPs.☆27Mar 20, 2025Updated last year
- Scripts to manage "Auto Time Zone Updater" 'tzautoupdate' service on a Windows device. Intended to be used as "Remediations", in Microsof…☆18Jul 12, 2024Updated 2 years ago
- Slides for COM Hijacking AV/EDR Talk on 38c3☆75Jan 3, 2025Updated last year
- ☆31Feb 28, 2025Updated last year
- A proof‑of‑concept C2 framework that uses Server‑Sent Events (SSE) and the MCP protocol for agent registration, command dispatch, and res…☆35Apr 28, 2025Updated last year
- Querying And Deleting Shadow Copies Using The IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS & IOCTL_VOLSNAP_DELETE_SNAPSHOT IOCTLs☆22Aug 7, 2025Updated last year
- Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common system-nat…☆285Feb 13, 2026Updated 8 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Browser extension blocking scam and phishing pages https://chromewebstore.google.com/detail/nehboro/ljgklnaofelbcnegjniagpmjknkmaiom☆17Apr 22, 2026Updated 6 months ago
- ☆23Jun 1, 2022Updated 4 years ago
- Indicators of compromise from to analysis and research by Nextron Threat Research team☆25Updated this week
- ☆15Sep 24, 2024Updated 2 years ago
- Expose a lot of MDE telemetry that is not easily accessible in any searchable form☆122Aug 19, 2025Updated last year
- This script will enable you to reset the krbtgt account password and related keys while minimizing the likelihood of Kerberos authenticat…☆15Oct 23, 2022Updated 4 years ago
- Tool designed to exfiltrate OneDrive Business OCR Data☆134Jan 27, 2025Updated last year
- This repo contains a list of vendors that hide their security advisories, alerts, notices, vulnerabilities, and more behind either a payw…☆32May 11, 2024Updated 2 years ago
- ☆266May 9, 2024Updated 2 years ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- ☆33Aug 22, 2026Updated 2 months ago
- Resources and Discussions About Detection Engineering☆12Sep 28, 2022Updated 4 years ago
- The home of the SDDLMaker☆29Jan 13, 2025Updated last year
- Dropping a powershell script at %HOMEPATH%\Documents\WindowsPowershell\ , that contains the implant's path , and whenever powershell pro…☆84Aug 2, 2023Updated 3 years ago
- ☆240Jun 10, 2025Updated last year
- "Service-less" driver loading☆192Nov 28, 2024Updated last year
- Static Encrypt is an crate that encrypts string literals at compile time and only decrypted at runtime when needed.☆61Jan 17, 2026Updated 9 months ago
- Shellcode loader☆104Nov 24, 2024Updated last year
- Active Directory Group Policy analyzer☆17Sep 20, 2019Updated 7 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Collect Windows telemetry for Maldev☆514Aug 14, 2026Updated 2 months ago
- bin2json extract recursively file, directory of files (or disk dump) metadata to json☆12Jul 7, 2022Updated 4 years ago
- ETWhat is a Windows utility that determines whether Event Tracing for Windows (ETW) providers operate in kernel mode or user mode.☆10Jun 9, 2025Updated last year
- Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.☆242Sep 26, 2023Updated 3 years ago
- http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html☆134Jul 20, 2024Updated 2 years ago
- Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques☆132Dec 28, 2025Updated 10 months ago
- Shellcode encryptor using a substitution cipher with a randomly generated key.☆144Jan 18, 2025Updated last year