socjordi / sauronLinks
Windows Monitoring Agent (process creation + DLL loading monitor + network monitor + file system access monitor + etc)
☆63Updated 6 years ago
Alternatives and similar repositories for sauron
Users that are interested in sauron are comparing it to the libraries listed below
Sorting:
- A simple ransomware defender.It uses minifilter to filt "rewrite" and "delete" events in kernel.And it handles event in user mode.☆27Updated 7 years ago
- ☆29Updated 4 years ago
- Example of real-time Windows ETW packet capture session☆53Updated 8 years ago
- Windows file system minifilter driver which generates backup copies of certain files before they change☆48Updated 6 years ago
- it can extract functions from .dll, .exe, .sys and it be work! :)☆39Updated 6 years ago
- Trace events in real time sessions☆45Updated 2 years ago
- ☆33Updated 4 years ago
- HTTP/HTTPS/DNS inspector (windows driver)☆27Updated 6 years ago
- Simple command line version of Sysinternals WinObj. Currently just lists object names and types given an object manager directory.☆21Updated 2 years ago
- An open source library for operating the Windows Overlay Filter driver.☆22Updated 6 years ago
- Windows tool box library☆66Updated 7 years ago
- Library for ETW, ProcessTracker sample based on ETW☆33Updated 8 years ago
- Open Source Libraries Collection☆24Updated 9 years ago
- View handles and object for each object type☆64Updated 6 years ago
- A minifilter driver preserves all modified and deleted files.☆80Updated 10 years ago
- a sandbox project by sudami☆17Updated 7 years ago
- A drop-in replacement for the C++ STL for kernel mode Windows drivers. The goal is to have implementations for things like the standard a…☆32Updated 9 years ago
- Simple AntiVirus Driver example☆39Updated 7 years ago
- Easy Transparent Encrypted File System Based on Minifilter File System Driver☆35Updated last week
- A driver to intercept low level windows events☆64Updated 6 years ago
- ☆18Updated 7 years ago
- A stack and register based virtual machine which can compile and execute arbitrary code in runtime☆44Updated 6 months ago
- DTrace for Windows in userspace; Frontend to ETW☆27Updated 3 years ago
- Windows Server 2K3 NT 5☆12Updated 4 years ago
- You don't need install any wdk for development kernel driver☆24Updated 7 years ago
- x64 Kernel Hooks Detection☆24Updated 8 years ago
- Detects if a Kernel mode debugger is active by reading the value of KUSER_SHARED_DATA.KdDebuggerEnabled. It is a high level and portable …☆23Updated 8 years ago
- ☆32Updated 4 years ago
- fork HoShiMin Avanguard☆21Updated 7 years ago
- Windows ndiscap.sys adapter for WinPcap applications☆27Updated 9 years ago