xaitax / NTSleuthLinks
Comprehensive Windows Syscall Extraction & Analysis Framework
☆153Updated 3 months ago
Alternatives and similar repositories for NTSleuth
Users that are interested in NTSleuth are comparing it to the libraries listed below
Sorting:
- ☆108Updated last year
- "Service-less" driver loading☆165Updated last year
- Obex – Blocking unwanted DLLs in user mode☆275Updated 2 months ago
- lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.☆117Updated last year
- Payload encoding utility to effectively lower payload entropy.☆119Updated 7 months ago
- Windows rootkit designed to work with BYOVD exploits☆211Updated 10 months ago
- SetupHijack is a security research tool that exploits race conditions and insecure file handling in Windows applications installer and up…☆259Updated 2 months ago
- Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.☆161Updated 4 months ago
- Activation Context Hijack☆169Updated 4 months ago
- Direct access to NTFS volumes☆290Updated 3 months ago
- A collection of PoCs to do common things in unconventional ways☆118Updated 3 months ago
- A Mythic Agent written in PIC C.☆203Updated 10 months ago
- A Windows Named Pipe Multi-tool / Proxy☆76Updated this week
- .NET tool used to enrich RPC telemetry☆100Updated 5 months ago
- A 64 bit executable junk code engine for polymorphic malware.☆73Updated 5 months ago
- ☆159Updated 11 months ago
- ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.☆132Updated 7 months ago
- Remote DLL Injection with Timer-based Shellcode Execution☆151Updated 4 months ago
- ☆146Updated last year
- ☆164Updated 9 months ago
- Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…☆151Updated 2 weeks ago
- Injecting DLL into LSASS at boot☆154Updated 7 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆136Updated 3 months ago
- Code execution/injection technique using DLL PEB module structure manipulation☆215Updated 6 months ago
- Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows …☆251Updated 2 months ago
- ☆61Updated 7 months ago
- Enumerate active EDR's on the system☆146Updated 2 months ago
- KVC enables unsigned driver loading via DSE bypass (g_CiOptions patch, skci.dll hijack, SeCiCallbacks redirection) and PP/PPL manipulatio…☆129Updated last week
- Tools for analyzing EDR agents☆271Updated last year
- Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination…☆139Updated last year