Correlating kernel notifications with the lack of ETW events to detect ETW Patching
Appears on
Quick read
Latest capture 2026-10-14 03:11
Archive status reflects the last catalog sync, not a maintenance assessment. Check recent releases, issue responses, and fit for your project with the repository shortlisting checklist.
0 paths
Agent instructions and tool configuration found in this repository.
No config files detected.
5 observed captures since 2026-06-24. Observed captures are shown by default.
Stars from first capture 0
Observed captures only
All tracked data
Observed snapshots
Observed snapshots
Nearest indexed repositories by embedding similarity.
Proof of Concepts code for Bring Your Own Vulnerable Driver techniques
Proof of Concepts code for Bring Your Own Vulnerable Driver techniques
Leaking kernel addresses from ETW consumers. Requires Administrator privileges.
Enumerating and removing kernel callbacks using signed vulnerable drivers
It's pointy and it hurts!
Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods BYOVD
