ETWProcessMon2
ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
AI summary
ETW monitor
A tool for monitoring and detecting malicious activity via ETW events
- stars
- 294
- forks
- 67
- watching
- 10
- #blueteam
- #cobaltstrike-detection
- #detection-etw-events
- #etw
- #imageloads
- #malicious-traffic-detection
- #memory-scanner
- #memory-scanner-by-etw-events
- #memory-scanning
- #meterpreter-detection
- #payload-detection
- #processmonitoring
- #realtime-monitoring
- #remote-thread-injection
- #tcpip-monitoring
- #technique-detection
- #thread-monitor
- #threat-hunting-via-etw
- #threat-hunting-via-sysmon
- #virtualmemallocation-detection
Similar projects
Found by comparing what the projects do, not just their names.
Process Monitor
An Electron process monitor and watcher that restarts or reloads applications when files change.
Traffic analyzer
Detects malicious servers in network traffic by analyzing encoded byte patterns
Malware analyzer
Analyzes and dissects malware and obfuscated code from various attack frameworks like Metasploit and Cobalt Strike
droe/xnumon230
Process Monitor
Monitors macOS systems for malicious activity by tracking process activity and system calls
Data scanner
Detects exposed secrets and personal data in GitLab repositories
Beacon Detector
A tool for detecting and responding to potential Cobalt Strike beacons using Extended Trace Record (ETW) tracing
System monitor
A tool that provides remote system information and monitoring capabilities
DC Synchronization Monitor
Detects unauthorized Domain Controller synchronization attempts and logs alerts to the Windows Event Log.
Event processor
A fast and extensible system for processing JSON events from security monitoring tools
System monitor
A configuration package for advanced system monitoring using Sysmon, designed to detect and alert on various threat activities and provide forensic visibility.
Server monitor
A tool for monitoring servers and services with real-time notification capabilities.
ETW bypass tool
Tool to bypass ETW (Event Tracing for Windows) security measure in remote processes by injecting a custom syscall
Memory analyzer
Analyzes and validates physical memory from various systems to extract process information and hypervisor details
etsy/411973
Alert monitor
An application for managing alerts and scheduling searches against various data sources to detect anomalies in log lines, metrics, and system behavior.
Dotnet error tracker
A Sentry SDK for .NET that enables crash reporting and performance monitoring in C# applications.
