reecdeep / hollowise
Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis tool from malware detection
☆36Updated 2 months ago
Alternatives and similar repositories for hollowise:
Users that are interested in hollowise are comparing it to the libraries listed below
- a tiny program to consume from ETW providers for research☆47Updated 4 months ago
- ☆27Updated 5 months ago
- Scan files for potential threats while leveraging AMSI (Antimalware Scan Interface) and Windows Defender. By isolating malicious content.☆16Updated 4 months ago
- This repository is meant to catalog network and host artifacts associated with various EDR products "shell" and response functionalities.☆78Updated 8 months ago
- Lena's scripts/code/resources for malware analysis☆26Updated 10 months ago
- Repo containing my public talks☆23Updated last year
- Powershell Linter☆50Updated last week
- quASAR: ASAR manipulation made easy☆37Updated 2 years ago
- ☆23Updated 2 months ago
- MITRE TTPs derived from Conti's leaked playbooks from XSS.IS☆37Updated 3 years ago
- GoResolver is a Go analysis tool using both Go symbol extraction and Control Flow Graph (CFG) similarity to identify and resolve the func…☆46Updated last week
- Small Python tool to do DLL Sideloading (and consequently, other DLL attacks).☆56Updated 2 years ago
- ☆14Updated last year
- Golang bindings for PE-sieve☆43Updated last year
- Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!☆82Updated last year
- IDA Python scripts☆35Updated 3 weeks ago
- ☆20Updated last year
- ☆37Updated last year
- BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.☆35Updated 3 months ago
- Ghosting-AMSI☆17Updated last week
- ☆105Updated 6 months ago
- ☆29Updated 2 months ago
- A proof-of-concept re-assembler for reverse VNC traffic.☆25Updated last year
- ☆45Updated last month
- These FLARE-VM configuration files are designed to be help setup a purpose-built installation, remove unnecessary packages to help stream…☆14Updated last year
- A simple commandline application to automatically decrypt strings from Obfuscator protected binaries☆45Updated 10 months ago
- A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue☆98Updated last year
- ☆75Updated 9 months ago
- ☆80Updated 5 months ago
- ☆10Updated last year