Alternatives and similar repositories for Windows-Internals-Learning-Resources:

Users that are interested in Windows-Internals-Learning-Resources are comparing it to the libraries listed below

• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆115Updated 7 months ago
• OtterHacker / Hooker
  ☆103Updated 3 months ago
• jsecurity101 / ETWInspector
  ☆154Updated 9 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆99Updated 5 months ago
• jsecurity101 / PowerParse
  PowerShell PE Parser
  ☆61Updated 7 months ago
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆124Updated 5 months ago
• rtfmkiesel / loldrivers-client
  Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io
  ☆81Updated last year
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆149Updated 2 months ago
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆132Updated last year
• deepinstinct / ShimMe
  ☆136Updated 3 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆160Updated last month
• sensepost / mydumbedr
  ☆112Updated last year
• ricardojoserf / NativeBypassCredGuard
  Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
  ☆216Updated 2 months ago
• struppigel / hedgehog-tools
  ☆111Updated 2 months ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆219Updated 8 months ago
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆306Updated last year
• rad9800 / FileRenameJunctionsEDRDisable
  ☆142Updated 2 months ago
• dr4k0nia / tooling-playground
  A collection of small scripts and tools for deobfuscation and malware analysis.
  ☆66Updated last year
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆297Updated last week
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆96Updated 10 months ago
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆203Updated 3 months ago
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆79Updated last year
• Maldev-Academy / RemoteTLSCallbackInjection
  Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process
  ☆242Updated last year
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆171Updated 2 weeks ago
• FuzzySecurity / BHUSA-2023
  ☆105Updated 7 months ago
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆321Updated 6 months ago
• ArtemBaranov / WindowsRootkitsGuide
  ☆63Updated 2 weeks ago
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆131Updated 8 months ago
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆243Updated 10 months ago
• t0-retooling / defender-recon24
  ☆49Updated 4 months ago