zodiacon / TaskSched

Related projects: ⓘ

• zodiacon / InfStudio
  INF Studio for easier working with driver installation files
  ☆36Updated 10 months ago
• DebugPrivilege / WindowsAP1
  Code samples that serve as references for Windows API functions
  ☆11Updated 3 months ago
• zodiacon / pstools-rust
  ☆12Updated 3 years ago
• zodiacon / BITSManager
  BITS Transfers Manager
  ☆37Updated 2 years ago
• secana / CertDump
  Dump certificates from PE files in different formats
  ☆36Updated 8 months ago
• jborean93 / PSDetour-Hooks
  Auditing Hooks for https://github.com/jborean93/PSDetour
  ☆12Updated 3 weeks ago
• decoder-it / CreateTokenExample
  ☆16Updated 5 years ago
• Fleex255 / CustomShim
  Example/starter code for custom Windows application compatibility shims
  ☆29Updated 3 years ago
• zodiacon / AccessMask
  ☆18Updated 5 years ago
• malcomvetter / WMIProcessWatcher
  An example pattern in C# for using WMI to monitor process creation and termination events.
  ☆51Updated 6 years ago
• tyranid / setsidmapping
  Simple tool to use LsaManageSidNameMapping get LSA to add or remove SID to name mappings.
  ☆23Updated 3 years ago
• zodiacon / NativeApps
  Demos and presentation from SECArmy Village Grayhat 2020
  ☆36Updated last year
• mobdk / CloneProcess
  Clone running process with ZwCreateProcess
  ☆58Updated 3 years ago
• gpoguy / setpol
  Lets you write arbitrary registry entries to Group Policy related .pol files (e.g. registry.pol)
  ☆11Updated 4 years ago
• nccgroup / mimikatz-detector-condrv
  The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent …
  ☆34Updated 2 years ago
• zodiacon / DeviceExplorer
  ☆38Updated last year
• SandboxEscaper / msihijacker
  ☆31Updated this week
• Biswa96 / TraceEvent
  Trace events in real time sessions
  ☆42Updated last year
• securesean / Shim-Process-Scanner
  Windows x64 Process Scanner to detect application compatability shims
  ☆37Updated 5 years ago
• hasherezade / pin_n_sieve
  An experimental dynamic malware unpacker based on Intel Pin and PE-sieve
  ☆57Updated 3 weeks ago
• nccgroup / WindowsMemPageDelta
  A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
  ☆28Updated 3 years ago
• zodiacon / winsta
  Show Window Stations, Desktops and top level windows
  ☆15Updated last year
• airbus-cert / etwbreaker
  An IDA plugin to deal with Event Tracing for Windows (ETW)
  ☆49Updated 2 years ago
• repnz / windows-imports-searcher
  Support Windows OS Reversing by searching easily for references to functions across many DLLs
  ☆33Updated 2 years ago
• TheWover / ModuleMonitor
  Uses WMI Event Win32_ModuleLoadTrace to monitor module loading. Provides filters, and detailed data. Has an option to monitor for CLR Inj…
  ☆39Updated 5 years ago
• AndreyBazhan / DbgPkg
  Scripts to prepare Windows system for debugging.
  ☆29Updated 3 years ago
• h4xu3lyn / NTLib
  Headers for linking your software with ntdll.dll
  ☆15Updated 3 years ago
• hasherezade / libpeconv_tpl
  A ready-made template for a project based on libpeconv.
  ☆40Updated last year
• Harvester57 / CodeIntegrity-DriverBlocklist
  ☆19Updated this week
• tux3 / crowdstrike-cloudproto
  Async rust support for the reverse-engineered Crowdstrike Falcon protocol between the Sensor and cloud services
  ☆9Updated last year