jdu2600/ETW-PPL-Tester

Stars
2
Language
C++
Created 4 months ago
Updated 4 months ago

jdu2600/ETW-PPL-Tester

jdu2600

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Consume Threat-Intelligence ETW using krabsetw and BYOVD

Windows10EtwEvents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions

CFG-FindHiddenShellcode

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

EtwTi-FluctuationMonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

Etw-SyscallMonitor

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

Get-InjectedThreadEx

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

API-To-ETW

Uses ghidra to find all ETW write metadata for each API in a PE file

RpcRegistrationMonitor