
attack_monitor
Endpoint detection & Malware analysis software

Endpoint detection & Malware analysis software

Basic injectable for analyzing the behavior of evasive malware

👁🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

Archived copy of the mod_plaintext.py "Internet Chemotherapy" IoT worm payload, preserved with archival references for malware research and…

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

Live hunting of code injection techniques

Kernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…

Extended kernel lazy importer for Windows drivers that resolves APIs at runtime with encrypted, cached import names to hide kernel function usage…

A collection of my yara rules

ML-based detection of Zombie ZIP archive header evasion attacks (CVE-2026-0866)

Zero-retraining sanitization that reorders permutation-equivalent neural network units to destroy malware embedded via weight-steganography attacks…

Defensive PowerShell tool for static inspection of RAR archives and detection of CVE-2025-8088 path traversal anomalies.

Detection signature repository providing YARA rules and threat-hunting content for identifying malware and malicious activity across enterprise…

Windows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…

Red Team C code repo

VBScript & VBA source-to-source deobfuscator with partial-evaluation