psmitty7373 / eif
Evil Reflective DLL Injection Finder
☆45Updated 5 years ago
Related projects ⓘ
Alternatives and complementary repositories for eif
- a program to detect reflective dll injection on a live machine☆74Updated 8 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago
- Shim database persistence (Fin7 TTP)☆35Updated 4 years ago
- POSHSPY backdoor code☆43Updated 7 years ago
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆36Updated 8 years ago
- Babel-Shellfish deobfuscates and scans Powershell scripts on real-time right before each line execution.☆41Updated 6 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆73Updated 10 years ago
- ☆26Updated last year
- Handy scripts to speed up malware analysis☆35Updated last year
- A C++ POC for process injection using NtCreateSectrion, NtMapViewOfSection and RtlCreateUserThread. Credit to @spotheplanet for his notes…☆42Updated 3 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆106Updated 3 years ago
- A repository of some of my Windows 10 Device Guard Bypasses☆133Updated 7 years ago
- Reflective Polymorphism☆104Updated 6 years ago
- ☆21Updated 8 years ago
- Enumerate Windows Defender threat families and dump their names according category☆86Updated 5 years ago
- Trace ScriptBlock execution for powershell v2☆39Updated 4 years ago
- Windows Drivers☆95Updated 5 years ago
- Binary commandline executable to parse ETL files☆67Updated 6 years ago
- PoC malware built by copy-paste☆24Updated 3 years ago
- Mario & Luigi - Tools for sniffing Windows Named Pipes communication☆129Updated 8 years ago
- few months old but better than nothing☆58Updated 2 years ago
- ☆21Updated 3 years ago
- PoC for Bypassing UM Hooks By Bruteforcing Intel Syscalls☆39Updated 9 years ago
- Telsy CTI Research Team☆57Updated 3 years ago
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.☆93Updated 6 years ago
- TA505 unpacker Python 2.7☆46Updated 4 years ago
- Another Repo of Malware. Enjoy. <3☆60Updated 5 years ago
- Process reimaging proof of concept code☆95Updated 5 years ago