Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
| Date | Stars |
|---|---|
| 2026-07-31 | 300 |
| 2026-08-06 | 300 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# TiEtwAgent - ETW-based process injection detection  This project was created to research, build and test different memory injection detection use cases and bypass techniques. The agent utilizes Microsoft-Windows-Threat-Intelligence event tracing provider, as a more modern and stable alternative to Userland-hooking, with the benefit of Kernel-mode visibility. The project depends on the [microsoft/krabsetw](https://github.com/microsoft/krabsetw) library for ETS setup and consumption. An accompanying blog post can be found here: https://blog.redbluepurple.io/windows-security-research/kernel-tracing-injection-detection  # Adding new detections Detection functions can be easily added in `DetectionLogic.cpp`, and called from `detect_event(GenericEvent evt)` for any source event type. Support for new event fields can be easily added by appending their name to the map in `GenericEvent` class declaration. # Setup instructions Assuming you do not have a Microsoft-trusted signing certificate: - Put your machine in the test signing mode with bcdedit - Generate a self-signed certificate with ELAM and Code Signing EKU - Sign TiEtwAgent.exe and your ELAM driver with the certificate - ./TiEtwAgent install - net start TiEtwAgent - Look for logs, by default in C:\Windows\Temp\TiEtwAgent.txt # TODO - [x] PPL Service, event parsing - [x] First detection - [ ] Detection lifecycle - [ ] Risk based lifecycle PS. If you do not want to write an ELAM driver, you can get one from https://github.com/pathtofile/PPLRunner/tree/main/elam_driver Special thanks to [@pathtofile](https://github.com/pathtofile) for the post here: https://blog.tofile.dev/2020/12/16/elam.html
Excerpt of 1,816 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
Not classified yet. Classification runs as part of npm run ingest.