jdu2600/CFG-FindHiddenShellcode

Stars
98
Rank 345,882 (Top 7 %)
Language
C++
Created over 1 year ago
Updated over 1 year ago

jdu2600/CFG-FindHiddenShellcode

jdu2600

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

Windows10EtwEvents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions

EtwTi-FluctuationMonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

Etw-SyscallMonitor

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

Get-InjectedThreadEx

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

API-To-ETW

Uses ghidra to find all ETW write metadata for each API in a PE file

ETW-PPL-Tester

Consume Threat-Intelligence ETW using krabsetw and BYOVD

RpcRegistrationMonitor