jdu2600/Etw-SyscallMonitor jdu2600/Etw-SyscallMonitor

  • Stars
    star
    40
  • Rank 677,691 (Top 14 %)
  • Language
    C#
  • Created over 1 year ago
  • Updated over 1 year ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
jdu2600/Etw-SyscallMonitor
github

jdu2600

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

More Repositories

1

Windows10EtwEvents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions
C#
259
star
2

CFG-FindHiddenShellcode

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
C++
91
star
3

EtwTi-FluctuationMonitor

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
C++
87
star
4

Get-InjectedThreadEx

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
PowerShell
22
star
5

API-To-ETW

Uses ghidra to find all ETW write metadata for each API in a PE file
Java
9
star
6

RpcRegistrationMonitor

C#
2
star