jdu2600

John U's repositories

Events from all manifest-based and mof-based ETW providers across Windows 10 versions

Language:C#259 100

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

Language:C++92 4 1

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

Language:C++89 30

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

Language:C#43 10

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

Language:PowerShellMIT23 20

Uses ghidra to find all ETW write metadata for each API in a PE file

Language:Java600

View ETW Provider manifest

Language:C#200

Portable Executable (PE) library written in .Net

Language:C#Apache-2.0200

Language:C#2 20

Consume Threat-Intelligence ETW using krabsetw and BYOVD

Language:C++100

KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

Language:C++NOASSERTION100

This project aims to compare and evaluate the telemetry of various EDR products.

Language:PowerShell000

Slide decks from various conference and meetup talks.

000

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

Language:C++MIT000

Generic Signature Format for SIEM Systems

Language:Python000