John U

Events from all manifest-based and mof-based ETW providers across Windows 10 versions

jdu2600

Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

jdu2600

Monitors ETW for security relevant syscalls maintaining the set called by each unique process

jdu2600

Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

jdu2600

Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

jdu2600