Zac Brown

PowerKrabsEtw. PowerKrabsEtw is a PowerShell interface for doing real-time ETW tracing.

hiddentreasure-etw-demo. Basic demo for Hidden Treasure talk.

PowerShellMethodAuditor. PowerShellMethodAuditor listens to the PowerShell ETW provider and logs PowerShell method invocations.

simplevm. Simple virtual machine for teaching basic concepts of virtual machine implementation.

flatkrabsetw. flatkrabsetw is a flat-C wrapper around the krabsetw C++ library. It's primarily meant for FFI usage in other languages.

configs. Zac's assorted config files

osquery-rs. Rust bindings for osquery

throf. A simple concatenative programming language influenced by Forth, Factor, and PostScript.

samples. Various samples used in my blog posts.

krabsetw. KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.

aws-secretsmanager-delete-4real. A cli tool to well and truly delete an AWS Secrets Manager secret.

EtwDotNetLoadMonitor. Detect when core .NET dll's are loaded into processes.