jdu2600 Goto Github PK

cfg-findhiddenshellcode

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

conference_talks

Slide decks from various conference and meetup talks.

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

edr-telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

endpoint

etw-syscallmonitor

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

etwexplorer

View ETW Provider manifest

etwti-fluctuationmonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

get-injectedthreadex

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

kibana

Your window into the Elastic Stack

krabsetw

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

penet

Portable Executable (PE) library written in .Net

rpcregistrationmonitor

sealighterti

Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider

sigma

Generic Signature Format for SIEM Systems

win32_docs

Public mirror for win32-pr

windows10etwevents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions