Popular repositories Loading

1. Windows10EtwEvents Windows10EtwEvents Public

   Events from all manifest-based and mof-based ETW providers across Windows 10 versions

   C# 326 66

2. EtwTi-FluctuationMonitor EtwTi-FluctuationMonitor Public

   Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

   C++ 160 16

3. CFG-FindHiddenShellcode CFG-FindHiddenShellcode Public

   Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

   C++ 129 14

4. Etw-SyscallMonitor Etw-SyscallMonitor Public

   Monitors ETW for security relevant syscalls maintaining the set called by each unique process

   C# 87 11

5. Get-InjectedThreadEx Get-InjectedThreadEx Public

   Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

   PowerShell 49 8

6. API-To-ETW API-To-ETW Public

   Uses ghidra to find all ETW write metadata for each API in a PE file

   Java 24 6