Popular repositories Loading

1. Windows10EtwEvents Windows10EtwEvents Public

   Events from all manifest-based and mof-based ETW providers across Windows 10 versions

   C# 269 56

2. CFG-FindHiddenShellcode CFG-FindHiddenShellcode Public

   Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

   C++ 100 12

3. EtwTi-FluctuationMonitor EtwTi-FluctuationMonitor Public

   Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

   C++ 96 10

4. Etw-SyscallMonitor Etw-SyscallMonitor Public

   Monitors ETW for security relevant syscalls maintaining the set called by each unique process

   C# 49 5

5. Get-InjectedThreadEx Get-InjectedThreadEx Public

   Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

   PowerShell 27 4

6. API-To-ETW API-To-ETW Public

   Uses ghidra to find all ETW write metadata for each API in a PE file

   Java 11 1