gavz Goto Github PK

syscall_intercept

The system call intercepting library

syscallpoc

Shellcode injection POC using syscalls.

syscalls

An example of using Syscalls in C# to get a meterpreter shell.

syscallsexample

Simple project using syscalls (via Syswhispers2) to execute MessageBox shellcode.

syscallsextractor

syscallslib

a library that automates some clean syscalls to make it easier to implement

syscalltest

PoC for Bypassing UM Hooks By Bruteforcing Intel Syscalls

syser

syser debugger x32/x64 ring3 with source level debugging

sysmo-usim-tool

Modified version of sysmo-usim-tool

sysmon

sysmon-1

Sysmon shenanigans

sysmon-cheatsheet

All sysmon event types and their fields explained

sysmon-config

Sysmon configuration file template with default high-quality event tracing

sysmon-dfir

Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.

sysmon-modular

A repository of sysmon configuration modules

sysmon-splunk-app

Sysmon Splunk App

sysmonente

sysmonhunter

An easy ATT&CK-based Sysmon hunting tool, showing in Blackhat USA 2019 Arsenal

sysmonsearch

Investigate suspicious activity by visualizing Sysmon's event log

sysmonsimulator

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams.

sysmontools

Utilities for Sysmon

system_call_hook_win10_1903

This is the P.O.C source for hooking the system calls on Windows 10 (1903) using it's dynamic trace feature weakness

systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

systemnightmare

Gives you instant SYSTEM command prompt on all supported and legacy versions of Windows

systemtoken

Steal privileged token to obtain SYSTEM shell

syswhispers

AV/EDR evasion via direct system calls.

syswhispers-functionrandomizer

Quick python script to replace the NtAPI functions within SysWhispers' assembly and header files with random strings

syswhispers2

AV/EDR evasion via direct system calls.

syswhispers2_x86

X86 version of syswhispers2 / x86 direct system call

syswhispers2bof

Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs