psmitty7373 / eif
Evil Reflective DLL Injection Finder
☆47Updated 6 years ago
Alternatives and similar repositories for eif:
Users that are interested in eif are comparing it to the libraries listed below
- a program to detect reflective dll injection on a live machine☆75Updated 9 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆43Updated 6 years ago
- POSHSPY backdoor code☆43Updated 8 years ago
- ☆21Updated 9 years ago
- Shim database persistence (Fin7 TTP)☆37Updated 5 years ago
- Userland API monitor for threat hunting☆58Updated 5 years ago
- Telsy CTI Research Team☆57Updated 4 years ago
- A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.☆95Updated 7 years ago
- Binary commandline executable to parse ETL files☆67Updated 6 years ago
- ☆63Updated 8 years ago
- Trace ScriptBlock execution for powershell v2☆40Updated 5 years ago
- Windows Drivers☆97Updated 6 years ago
- ☆52Updated 6 years ago
- Basic demo for Hidden Treasure talk.☆49Updated 7 years ago
- A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes…☆43Updated 3 years ago
- Reflective Polymorphism☆104Updated 6 years ago
- Handy scripts to speed up malware analysis☆35Updated last year
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- Mario & Luigi - Tools for sniffing Windows Named Pipes communication☆129Updated 8 years ago
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆36Updated 8 years ago
- Theat hunting notes in flat file format and mapped to MITRE's ATT&CK IDs☆42Updated 6 years ago
- Removal of certain event logs within a Windows OS☆8Updated 5 years ago
- SilkETW & SilkService☆40Updated 5 years ago
- Bypassing User Account Control (UAC) using TpmInit.exe☆42Updated 8 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆75Updated 10 years ago
- A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection☆31Updated 4 years ago
- A repository of some of my Windows 10 Device Guard Bypasses☆135Updated 7 years ago
- Extract the password of the current user from flow (keylogger, config file, ..) Use SSPI to get a valid NTLM challenge/response and test …☆58Updated 6 years ago
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆31Updated 4 years ago