jdu2600/EtwTi-FluctuationMonitor jdu2600/EtwTi-FluctuationMonitor

  • Stars
    star
    87
  • Rank 377,196 (Top 8 %)
  • Language
    C++
  • Created over 1 year ago
  • Updated over 1 year ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
jdu2600/EtwTi-FluctuationMonitor
github

jdu2600

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

More Repositories

1

Windows10EtwEvents

Events from all manifest-based and mof-based ETW providers across Windows 10 versions
C#
259
star
2

CFG-FindHiddenShellcode

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
C++
91
star
3

Etw-SyscallMonitor

Monitors ETW for security relevant syscalls maintaining the set called by each unique process
C#
40
star
4

Get-InjectedThreadEx

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
PowerShell
22
star
5

API-To-ETW

Uses ghidra to find all ETW write metadata for each API in a PE file
Java
9
star
6

RpcRegistrationMonitor

C#
2
star