n3mes1s Goto Github PK

alpclogger

Log ALPC activity

amsiscanner

A C/C++ implementation of Microsoft's Antimalware Scan Interface

apted

Python APTED algorithm for the Tree Edit Distance

apted-1

APTED algorithm for the Tree Edit Distance

at-ps

Adversary Tactics - PowerShell Training

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

awesome-yara

A curated list of awesome YARA rules, tools, and people.

capted

C++ Header Library port of APTED algorithm for computing Tree Edit Distance

cve-2020-0796

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

experiments

Expriments

exploitcapcom

This is a standalone exploit for a vulnerable feature in Capcom.sys

findfaces

C++OpenCV demo app with a rest endpoint for use in containers

haxm

Intel® Hardware Accelerated Execution Manager (Intel® HAXM)

heapy

A Simple Heap Profiler for Windows C/C++ Applications

hoss

Pedagogical Hypervisor, based on MIT JOS

hyperplatform

Intel VT-x based hypervisor aiming to provide a thin platform for research on Windows.

includeos

A minimal, resource efficient unikernel for cloud services

ioctlbf

Automatically exported from code.google.com/p/ioctlbf

ioctlfuzzer

Automatically exported from code.google.com/p/ioctlfuzzer

ir-tools

IR-Tools - PowerShell tools for IR

kdu

Kernel Driver Utility

khypervisor

kHypervisor is a lightweight bluepill-like nested VMM for Windows, it provides and emulating a basic function of Intel VT-x

lib-tdt

memorymon

Detecting execution of kernel memory where is not backed by any image file

mock-office-antivirus

This is a mock implementation of IOfficeAntiVirus. Once registered, it will be invoked as a part of the tests performed by IAttachmentExecute::Save(). You can modify it to simulate what would happen if an actual anti-virus product finds an infection during IAttachmentExecute::Save().

openai-api-rs

OpenAI API client library for Rust (unofficial)

osquery

SQL powered operating system instrumentation, monitoring, and analytics.

pdb-downloader

PDB Downloader - An easier way to download Microsoft's public symbols for Libraries and Executables.

ppdump-public

Protected Process (Light) Dump: Uses Zemana AntiMalware Engine To Open a Privileged Handle to a PP/PPL Process And Inject MiniDumpWriteDump() Shellcode

procfilter

A YARA-integrated process denial framework for Windows