C/C++ Performance Profiler
翻译 - C / C ++性能分析器
Adversary tradecraft detection, protection, and hunting
翻译 - Windows内核探索和跟踪工具
Command line tracing tool for Windows, based on ETW.
KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.
Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.
The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能， 而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发
My notes on software troubleshooting, covering debugging and tracing techniques and tools. Available at wtrace.net.
ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by VirtualMemAlloc Events (in-memory) etc.
Hades HIDS/HIPS for Windows
Capture and parse CDP and LLDP packets on local or remote computers
Meterpreter_Payload_Detection.exe tool for detecting Meterpreter in memory like IPS-IDS and Forensics tool
Simple project that demonstrates how an ETW consumer can be created just by using NTDLL