Pinned Repositories
API-To-ETW
Uses ghidra to find all ETW write metadata for each API in a PE file
CFG-FindHiddenShellcode
Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
ETW-PPL-Tester
Consume Threat-Intelligence ETW using krabsetw and BYOVD
Etw-SyscallMonitor
Monitors ETW for security relevant syscalls maintaining the set called by each unique process
EtwExplorer
View ETW Provider manifest
EtwTi-FluctuationMonitor
Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
Get-InjectedThreadEx
Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
PeNet
Portable Executable (PE) library written in .Net
RpcRegistrationMonitor
Windows10EtwEvents
Events from all manifest-based and mof-based ETW providers across Windows 10 versions
jdu2600's Repositories
jdu2600/Windows10EtwEvents
Events from all manifest-based and mof-based ETW providers across Windows 10 versions
jdu2600/CFG-FindHiddenShellcode
Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
jdu2600/EtwTi-FluctuationMonitor
Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
jdu2600/Etw-SyscallMonitor
Monitors ETW for security relevant syscalls maintaining the set called by each unique process
jdu2600/Get-InjectedThreadEx
Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
jdu2600/API-To-ETW
Uses ghidra to find all ETW write metadata for each API in a PE file
jdu2600/EtwExplorer
View ETW Provider manifest
jdu2600/PeNet
Portable Executable (PE) library written in .Net
jdu2600/RpcRegistrationMonitor
jdu2600/ETW-PPL-Tester
Consume Threat-Intelligence ETW using krabsetw and BYOVD
jdu2600/krabsetw
KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
jdu2600/EDR-Telemetry
This project aims to compare and evaluate the telemetry of various EDR products.
jdu2600/conference_talks
Slide decks from various conference and meetup talks.
jdu2600/Detours
Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
jdu2600/sigma
Generic Signature Format for SIEM Systems