Alternatives and similar repositories for HiveSwarming

Users that are interested in HiveSwarming are comparing it to the libraries listed below

• Fleex255 / CustomShim
  Example/starter code for custom Windows application compatibility shims
  ☆34Updated 4 years ago
• dr-anoroc / rawccopy
  Command line utility for copying files on NTFS using low level disk access
  ☆36Updated last year
• lilkui / runasti
  Runs programs as TrustedInstaller
  ☆49Updated 6 years ago
• zodiacon / WMIExplorer
  ☆24Updated 2 months ago
• zodiacon / RemoteThreadDetection
  Remote Thread Detection with a Kernel Driver
  ☆32Updated 8 months ago
• keowu / InstrumentationCallbackToolKit
  A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…
  ☆32Updated 2 years ago
• m417z / x64dbg-xfg-marker
  An x64dbg plugin which marks XFG call signatures as data
  ☆77Updated 2 years ago
• KiFilterFiberContext / windows-software-policy
  Research on obfuscated licensing APIs / CLIP service in the Windows kernel
  ☆122Updated 3 years ago
• jonaslyk / temp
  ☆71Updated 2 years ago
• m417z / thread-call-stack-scanner
  Safely manage the unloading of DLLs that have been hooked into a process. Context: https://github.com/KNSoft/KNSoft.SlimDetours/discussio…
  ☆79Updated 3 months ago
• DebugPrivilege / WindowsAP1
  Code samples that serve as references for Windows API functions
  ☆35Updated last year
• zodiacon / youtubecode
  Youtube channel sample code
  ☆51Updated this week
• 3dnow / NtCreateLowBoxToken
  A fully compatible replacement of Windows NT NtCreateLowBoxToken syscall - precisely restored from reverse engineering
  ☆41Updated 3 months ago
• C5Hackr / c_syscalls
  https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.
  ☆29Updated last year
• VergiliusProject / kernels-data
  Windows kernel PDB data parsed into YAML
  ☆41Updated 10 months ago
• rbmm / LdrpKernel32DllName
  ☆84Updated last year
• zodiacon / MalDevWorkshopWebinar
  Demo from the Malware Analysis and Development Webinar
  ☆23Updated last year
• hasherezade / pe2pic
  Small visualizator for PE files
  ☆70Updated 2 years ago
• bluefrostsecurity / Windows-Drive-Remapping-EoP
  ☆32Updated last year
• hasherezade / sig_finder
  Signature finder (from PE-bear)
  ☆38Updated last month
• Wack0 / SecureBootPolicyTools
  Take back control of Windows Code Integrity, no exploits or patching required! Requires that you control your own Platform Key (PK).
  ☆49Updated 3 years ago
• 7eRoM / elam
  A Practical example of ELAM (Early Launch Anti-Malware)
  ☆35Updated 3 years ago
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆90Updated last year
• zodiacon / VerifierDLL
  Example of building an application verifer DLL
  ☆49Updated last year
• Idov31 / UdpInspector
  Listing UDP connections with remote address without sniffing.
  ☆28Updated 2 years ago
• LloydLabs / process-enumeration-stealth
  ☆83Updated last year
• Flawww / NtSyscaller
  Manually perform syscalls without going through any external API or DLL.
  ☆19Updated 2 years ago
• MMitsuha / Tajimari
  the Open Source and Pure C++ Packer for eXecutables
  ☆21Updated 2 years ago
• nccgroup / mimikatz-detector-condrv
  The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent …
  ☆40Updated 3 years ago
• secana / CertDump
  Dump certificates from PE files in different formats
  ☆38Updated last year