John U

Windows10EtwEvents. Events from all manifest-based and mof-based ETW providers across Windows 10 versions

EtwTi-FluctuationMonitor. Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections

CFG-FindHiddenShellcode. Walks the CFG bitmap to find previously executable but currently hidden shellcode regions

Etw-SyscallMonitor. Monitors ETW for security relevant syscalls maintaining the set called by each unique process

Get-InjectedThreadEx. Fork of Get-InjectedThread - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2

API-To-ETW. Uses ghidra to find all ETW write metadata for each API in a PE file

ETW-PPL-Tester. Consume Threat-Intelligence ETW using krabsetw and BYOD

RpcRegistrationMonitor. C#

conference_talks. Slide decks from various conference and meetup talks.

EtwExplorer. View ETW Provider manifest