Alternatives and similar repositories for Windows-Internals-Learning-Resources:

Users that are interested in Windows-Internals-Learning-Resources are comparing it to the libraries listed below

• OtterHacker / Hooker
  ☆103Updated 4 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆114Updated 8 months ago
• jsecurity101 / ETWInspector
  ☆155Updated 10 months ago
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆79Updated last year
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆134Updated last year
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆148Updated 3 months ago
• dr4k0nia / tooling-playground
  A collection of small scripts and tools for deobfuscation and malware analysis.
  ☆66Updated last year
• struppigel / hedgehog-tools
  ☆111Updated last month
• FuzzySecurity / BHUSA-2023
  ☆105Updated 8 months ago
• rtfmkiesel / loldrivers-client
  Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io
  ☆82Updated last year
• sensepost / mydumbedr
  ☆114Updated last year
• rad9800 / FileRenameJunctionsEDRDisable
  ☆149Updated 3 months ago
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆138Updated 2 weeks ago
• ghostpepper108 / Evasion
  ☆107Updated last year
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆221Updated 9 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆106Updated 6 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆169Updated 2 months ago
• 20urc3 / Aplos
  Aplos an extremely simple fuzzer for Windows binaries.
  ☆68Updated last month
• deepinstinct / ShimMe
  ☆136Updated 4 months ago
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆183Updated last month
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆244Updated 11 months ago
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆125Updated 6 months ago
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆162Updated 9 months ago
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆207Updated 4 months ago
• cbecks2 / edr-artifacts
  This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.
  ☆76Updated 6 months ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆96Updated 11 months ago
• AaLl86 / WindowsInternals
  Contains all the applications developed for the Second part of the 7th Edition of Windows Internals book
  ☆106Updated 8 months ago
• fin3ss3g0d / StoneKeeper
  StoneKeeper C2, an experimental EDR evasion framework for research purposes
  ☆194Updated 2 months ago