xaitax / NTSleuthLinks
Comprehensive Windows Syscall Extraction & Analysis Framework
☆135Updated last month
Alternatives and similar repositories for NTSleuth
Users that are interested in NTSleuth are comparing it to the libraries listed below
Sorting:
- ☆108Updated 11 months ago
- "Service-less" driver loading☆161Updated 10 months ago
- A collection of PoCs to do common things in unconventional ways☆116Updated last month
- Payload encoding utility to effectively lower payload entropy.☆120Updated 5 months ago
- lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.☆115Updated last year
- ☆59Updated 5 months ago
- SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows applications installer and up…☆237Updated last week
- Stealthy x64 thread manipulation library for calling functions inside target processes without creating remote threads or installing hook…☆55Updated last month
- A Payload Analysis Framework☆105Updated this week
- Obex – Blocking unwanted DLLs in user mode☆227Updated 3 weeks ago
- .NET tool used to enrich RPC telemetry☆99Updated 3 months ago
- Bypasses AMSI protection through remote memory patching and parsing technique.☆50Updated 5 months ago
- Activation Context Hijack☆170Updated 2 months ago
- Vibe Malware Triage - MCP server for static PE analysis.☆70Updated 4 months ago
- This is the loader that supports running a program with Protected Process Light (PPL) protection functionality.☆239Updated 3 weeks ago
- MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.☆122Updated 10 months ago
- Windows rootkit designed to work with BYOVD exploits☆208Updated 8 months ago
- A Mythic Agent written in PIC C.☆200Updated 8 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆125Updated last month
- Dynamic shellcode loader with sophisticated evasion capabilities☆115Updated last week
- A 64 bit executable junk code engine for polymorphic malware.☆70Updated 3 months ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆155Updated 2 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆101Updated 6 months ago
- Convert your shellcode into an ASCII string☆120Updated 3 months ago
- Mentally ill EtwTi parser☆66Updated last month
- Enumerate active EDR's on the system☆130Updated 2 weeks ago
- ☆160Updated 7 months ago
- ☆159Updated 9 months ago
- Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when a…☆92Updated 3 months ago
- Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules☆126Updated this week