
TickTock
Enumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
defensive-toolsmalware-analysismemory-forensics

Enumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…

A host based IDS written in C# Targetted at Metasploit

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique