rajiv2790 / FalconEye
☆297Updated 4 years ago
Alternatives and similar repositories for FalconEye:
Users that are interested in FalconEye are comparing it to the libraries listed below
- Sysmon-Like research tool for ETW☆352Updated 2 years ago
- Yet another variant of Process Hollowing☆392Updated 3 months ago
- Security product hook detection☆318Updated 4 years ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆272Updated 4 years ago
- Expriments☆454Updated 7 months ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆208Updated 2 years ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆388Updated this week
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆559Updated 2 years ago
- Just another Windows Process Injection☆395Updated 4 years ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆766Updated 3 years ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆742Updated last year
- FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!☆332Updated 2 years ago
- A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.☆176Updated 2 weeks ago
- OffensivePH - use old Process Hacker driver to bypass several user-mode access controls☆332Updated 3 years ago
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆668Updated last year
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆658Updated last year
- Phantom DLL hollowing PoC☆360Updated 2 years ago
- Extract Windows Defender database from vdm files and unpack it☆440Updated 5 years ago
- Exploring RPC interfaces on Windows☆321Updated last year
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆109Updated 4 years ago
- ☆478Updated 2 years ago
- UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …☆348Updated 2 years ago
- A way to delete a locked file, or current running executable, on disk.☆524Updated 9 months ago
- Tools and PoCs for Windows syscall investigation.☆360Updated 4 months ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆324Updated last year
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆635Updated 2 years ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆301Updated last year
- KaynLdr is a Reflective Loader written in C/ASM☆536Updated last year
- Example code for EDR bypassing☆150Updated 6 years ago
- Quickly debug shellcode extracted during malware analysis☆603Updated last year