Popular repositories Loading

1. Windows10EtwEvents Windows10EtwEvents Public

   Events from all manifest-based and mof-based ETW providers across Windows 10 versions

   C# 275 58

2. EtwTi-FluctuationMonitor EtwTi-FluctuationMonitor Public

   Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

   C++ 102 11

3. CFG-FindHiddenShellcode CFG-FindHiddenShellcode Public

   Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

   C++ 100 12

4. Etw-SyscallMonitor Etw-SyscallMonitor Public

   Monitors ETW for security relevant syscalls maintaining the set called by each unique process

   C# 50 5

5. Get-InjectedThreadEx Get-InjectedThreadEx Public

   Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

   PowerShell 28 4

6. API-To-ETW API-To-ETW Public

   Uses ghidra to find all ETW write metadata for each API in a PE file

   Java 12 2