jdu2600/API-To-ETW jdu2600/API-To-ETW

  • Stars
    star
    10
  • Rank 1,807,489 (Top 36 %)
  • Language
    Java
  • Created over 4 years ago
  • Updated 4 months ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
jdu2600/API-To-ETW
github

jdu2600

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Uses ghidra to find all ETW write metadata for each API in a PE file

More Repositories

1

Windows10EtwEvents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions
C#
262
star
2

CFG-FindHiddenShellcode

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
C++
98
star
3

EtwTi-FluctuationMonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
C++
94
star
4

Etw-SyscallMonitor

Monitors ETW for security relevant syscalls maintaining the set called by each unique process
C#
49
star
5

Get-InjectedThreadEx

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
PowerShell
26
star
6

ETW-PPL-Tester

Consume Threat-Intelligence ETW using krabsetw and BYOVD
C++
2
star
7

RpcRegistrationMonitor

C#
2
star