xaitax / NTSleuthLinks
Comprehensive Windows Syscall Extraction & Analysis Framework
☆160Updated 4 months ago
Alternatives and similar repositories for NTSleuth
Users that are interested in NTSleuth are comparing it to the libraries listed below
Sorting:
- ☆108Updated last year
- A collection of PoCs to do common things in unconventional ways☆122Updated 4 months ago
- "Service-less" driver loading☆166Updated last year
- Obex – Blocking unwanted DLLs in user mode☆279Updated 4 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆138Updated 5 months ago
- Windows rootkit designed to work with BYOVD exploits☆211Updated last year
- A Windows Named Pipe Multi-tool / Proxy☆250Updated last month
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆165Updated 5 months ago
- lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.☆119Updated last year
- ☆60Updated 9 months ago
- A Mythic Agent written in PIC C.☆206Updated 11 months ago
- Payload encoding utility to effectively lower payload entropy.☆123Updated 9 months ago
- .NET tool used to enrich RPC telemetry☆101Updated 7 months ago
- Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…☆154Updated 2 months ago
- ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.☆130Updated 9 months ago
- SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows applications installer and up…☆260Updated 3 months ago
- Activation Context Hijack☆169Updated 5 months ago
- Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows …☆256Updated 4 months ago
- ☆147Updated last year
- KVC enables unsigned driver loading via DSE bypass (g_CiOptions patch, skci.dll hijack, SeCiCallbacks redirection) and PP/PPL manipulatio…☆154Updated this week
- Enumerate active EDR's on the system☆148Updated 4 months ago
- Injecting DLL into LSASS at boot☆156Updated 8 months ago
- AppLocker-Based EDR Neutralization☆277Updated last month
- Bypasses AMSI protection through remote memory patching and parsing technique.☆54Updated 8 months ago
- A tool to interact with Windows drivers to perform a raw disk read and parse out target files without calling standard Windows file APIs☆104Updated 4 months ago
- Direct access to NTFS volumes☆291Updated 4 months ago
- ☆159Updated last year
- Vibe Malware Triage - MCP server for static PE analysis.☆74Updated last month
- ☆164Updated 10 months ago
- A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.☆257Updated 4 months ago