Documentation and supporting script sample for Windows Exploit Guard
☆167Oct 2, 2026Updated 3 weeks ago
Alternatives and similar repositories for exploitguard
Users that are interested in exploitguard are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Process reimaging proof of concept code☆95Jun 21, 2019Updated 7 years ago
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆344Oct 12, 2026Updated 2 weeks ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆245Nov 6, 2019Updated 6 years ago
- An IDA plugin to deal with Event Tracing for Windows (ETW)☆56Jul 8, 2022Updated 4 years ago
- Finding Truth in the Shadows☆126Jan 26, 2023Updated 3 years ago
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆108Apr 24, 2020Updated 6 years ago
- A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies☆63Dec 18, 2023Updated 2 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆212Dec 6, 2022Updated 3 years ago
- Research on Windows Kernel Executive Callback Objects☆316Feb 22, 2020Updated 6 years ago
- Windows capability development using GCC and GNU Make☆23Nov 1, 2025Updated 11 months ago
- This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System f…☆289May 14, 2020Updated 6 years ago
- PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.☆430May 22, 2020Updated 6 years ago
- Run Processes as PPL with ELAM☆185Mar 17, 2022Updated 4 years ago
- Visual Studio Code Microsoft Sysinternal Sysmon configuration file extension.☆54Oct 12, 2026Updated 2 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Automate AV evasion by calling AMSI☆87May 31, 2023Updated 3 years ago
- Command like tool to print mitigation flags for running processes in a memory dump☆48Sep 18, 2020Updated 6 years ago
- Weaponizing Gigabyte driver for priv escalation and bypass PPL☆69Jun 30, 2019Updated 7 years ago
- VT-based PCI device monitor (SPI)☆158Oct 29, 2020Updated 6 years ago
- Silence EDRs by removing kernel callbacks☆236Dec 7, 2020Updated 5 years ago
- Evading WinDefender ATP credential-theft☆257Dec 2, 2019Updated 6 years ago
- A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies☆259Mar 2, 2022Updated 4 years ago
- CScriptShell, a Powershell Host running within cscript.exe☆163Apr 11, 2017Updated 9 years ago
- KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.☆812Updated this week
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Tools for discovery and abuse of COM hijacks☆337Oct 15, 2019Updated 7 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆90May 17, 2023Updated 3 years ago
- ☆31Feb 28, 2025Updated last year
- KPP bypass with alternative syscall pipeline☆31Feb 6, 2026Updated 8 months ago
- A tool to facilitate ROP Chain Development for XML Character Sanitization☆20May 9, 2019Updated 7 years ago
- Dump PDB Symbols including support for Bochs Debugging Format (with wine support)☆14Aug 11, 2023Updated 3 years ago
- Local privilege escalation PoC exploit for CVE-2019-16098☆200Sep 13, 2019Updated 7 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆222Sep 17, 2019Updated 7 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆861Mar 11, 2021Updated 5 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- PoC to demonstrate how CLR ETW events can be tampered.☆187Mar 26, 2020Updated 6 years ago
- Detect BypassUAC using AMSI☆29Feb 18, 2025Updated last year
- Tool to bypass LSA Protection (aka Protected Process Light)☆995Dec 4, 2022Updated 3 years ago
- Sysmon-Like research tool for ETW☆397Nov 15, 2022Updated 3 years ago
- Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().☆216Mar 5, 2020Updated 6 years ago
- Virtual Machine Introspection, Tracing & Debugging☆603Feb 22, 2022Updated 4 years ago
- Tools for instrumenting Windows Defender's mpengine.dll☆326Oct 25, 2018Updated 8 years ago