Alternatives and similar repositories for Windows-Internals-Learning-Resources:

Users that are interested in Windows-Internals-Learning-Resources are comparing it to the libraries listed below

• jsecurity101 / ETWInspector
  ☆155Updated 8 months ago
• OtterHacker / Hooker
  ☆102Updated 2 months ago
• CICADA8-Research / MyMSIAnalyzer
  Analyse MSI files for vulnerabilities
  ☆121Updated 4 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆114Updated 6 months ago
• hackerhouse-opensource / WMIProcessWatcher
  A CIA tradecraft technique to asynchronously detect when a process is created using WMI.
  ☆131Updated last year
• struppigel / hedgehog-tools
  ☆111Updated last month
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆147Updated last month
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆96Updated 9 months ago
• FuzzySecurity / BHUSA-2023
  ☆105Updated 6 months ago
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆79Updated last year
• deepinstinct / ContainYourself
  A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.
  ☆303Updated last year
• sensepost / mydumbedr
  ☆112Updated 11 months ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆214Updated 7 months ago
• rtfmkiesel / loldrivers-client
  Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io
  ☆82Updated 11 months ago
• TierZeroSecurity / edr_blocker
  Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…
  ☆141Updated 5 months ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆136Updated last month
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆268Updated last week
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆167Updated last week
• jsecurity101 / PowerParse
  PowerShell PE Parser
  ☆61Updated 6 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆71Updated 4 months ago
• floesen / EventLogCrasher
  ☆185Updated 11 months ago
• 0x4141414141 / Malware-Devlopment
  Work in progress experiments with reverse shells, AV bypass and extraction of secrets from memory in C
  ☆41Updated 5 years ago
• olafhartong / PockETWatcher
  a tiny program to consume from ETW providers for research
  ☆45Updated 2 weeks ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆110Updated this week
• thefLink / Hunt-Weird-Syscalls
  ETW based POC to identify direct and indirect syscalls
  ☆178Updated last year
• ArtemBaranov / WindowsRootkitsGuide
  ☆55Updated 3 weeks ago
• thiagopeixoto / winsos-poc
  A PoC demonstrating code execution via DLL Side-Loading in WinSxS binaries.
  ☆109Updated 10 months ago
• ghostpepper108 / Evasion
  ☆106Updated last year
• NtDallas / KrakenMask
  Sleep obfuscation
  ☆199Updated last month
• fortra / CVE-2024-6769
  Activation cache poisoning to elevate from medium to high integrity (CVE-2024-6769)
  ☆60Updated 3 months ago