whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

Noriben

Noriben Malware Analysis Sandbox Contact Information: @bbaskin on Twitter brian at thebaskins dot com Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you t...

Find-VulnerableElectronVersion

Find-VulnerableElectronVersion Scans an executable and determines if it was wrapped in an Electron version vulnerable to the Chromium vulnerability CVE-2023-4863/ CVE-2023-5129 using the Sysinternals tool Strings. Only supported on Windows devices. Requires Sysinternals to be installed:...

ProcDump-for-Linux

ProcDump ProcDump은 Windows용 Sysinternals 도구 모음에 포함된 클래식 ProcDump 도구를 Linux 및 Mac용으로 재해석한 것입니다. ProcDump는 성능 트리거를 기반으로 애플리케이션의 코어 덤프를 생성할 수 있는 편리한 방법을 Linux 및 Mac 개발자에게 제공합니다. Linux 및 Mac용 ProcDump는 Sysinternals의 일부입니다. 설치 및 사용법 요구 사항 최소 Linux OS: Red Hat Enterprise Linux / CentOS 7 Fedora 29 Ubun...

ps-ppl-bypass

Process Explorer vulnerable driver PPL Bypass While it is well known that old versions before 17.x of SysInternals Process Explorer drivers PSEXP152.sys are vulnerable and can be abused to open full access process handles to PPL processes IOCTL: 0x8335003c, newer versions 17.x upward are still...

ProcDump-for-Linux v3.5.3

ProcDump ProcDump is a Linux and Mac reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. ProcDump provides a convenient way for Linux and Mac developers to create core dumps of their application based on performance triggers. ProcDump for Linux and Mac is pa...

EUVD-2004-2720

Malware in sbrugna...

EUVD-2007-4206

Malware in sbrugna...

EUVD-2021-7197

Malicious code in bioql PyPI...

EUVD-2023-32926

Malicious code in bioql PyPI...

Exploit for Use After Free in Microsoft

CVE Analysis & Detection — PoCs, Snort Detection, and Mitigati...

CVE-2005-2679

Buffer overflow in Sysinternals Process Explorer 9.23, and other versions before 9.25, allows local users to execute arbitrary code via a long CompanyName field in the VersionInfo information in a running process...

How to Capture a Memory Dump from a Provisioned Target in a Hyper-V Environment

This article describes how to generate a memory dump file from a provisioned target in a Hyper-V environment.This process requires no modification to the virtual machine. Requirements Download and install the Debugging Tools for Windows package from Microsoft's web site: Debugging Tools for Windo...

VulnCheck KEV: CVE-2021-1733

Sysinternals PsExec Elevation of Privilege Vulnerability...

The vulnerability in the set of Sysinternals system utilities for Windows operating systems allows a hacker to trigger a service failure.

The vulnerability in the Sysinternals system utilities for Windows operating systems is related to the improper release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

Denial of service

Sysinternals Process Monitor for Windows Denial of Service Vulnerability...

CVE-2023-29353 Sysinternals Process Monitor for Windows Denial of Service Vulnerability

...