{"id":15035774,"url":"https://github.com/damonmohammadbagher/etwnetmonv3","last_synced_at":"2025-04-09T23:15:13.265Z","repository":{"id":41164058,"uuid":"372065061","full_name":"DamonMohammadbagher/ETWNetMonv3","owner":"DamonMohammadbagher","description":"ETWNetMonv3 is simple C# code for Monitoring TCP Network Connection via ETW \u0026 ETWProcessMon/2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection \u0026 Payload Detection by VirtualMemAlloc Events (in-memory) etc. ","archived":false,"fork":false,"pushed_at":"2023-06-06T06:39:25.000Z","size":1457,"stargazers_count":39,"open_issues_count":0,"forks_count":13,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-09T23:15:05.657Z","etag":null,"topics":["blue-team","blueteam","csharp-code","defensive","defensivetool","detection","etw","etw-monitoring-threads","meterpreter","networkmonitor","tcpv4","tcpview","threat-hunting"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DamonMohammadbagher.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-05-29T20:35:19.000Z","updated_at":"2025-02-19T10:26:08.000Z","dependencies_parsed_at":"2022-08-25T20:40:11.724Z","dependency_job_id":null,"html_url":"https://github.com/DamonMohammadbagher/ETWNetMonv3","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DamonMohammadbagher%2FETWNetMonv3","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DamonMohammadbagher%2FETWNetMonv3/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DamonMohammadbagher%2FETWNetMonv3/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DamonMohammadbagher%2FETWNetMonv3/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DamonMohammadbagher","download_url":"https://codeload.github.com/DamonMohammadbagher/ETWNetMonv3/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248125591,"owners_count":21051770,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blue-team","blueteam","csharp-code","defensive","defensivetool","detection","etw","etw-monitoring-threads","meterpreter","networkmonitor","tcpv4","tcpview","threat-hunting"],"created_at":"2024-09-24T20:29:27.274Z","updated_at":"2025-04-09T23:15:13.234Z","avatar_url":"https://github.com/DamonMohammadbagher.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ETWNetMonv3 \u0026 ETWProcessMon \n## \"ETWNetMonv3/ETWNetMonv3Agent\" is simple C# code for Monitoring TCP Network Connection via ETW \u0026 \"ETWProcessMon\" is for Monitoring Process/Thread/Memory/Imageload etc. \n-----------------\n### ETWNetMonv3.exe\n\"ETWNetMonv3.exe\" is Windows App for read/watching ETW Logs (which made by ETWNetMonv3Agent.exe), this code will publish with pdf files for chapter15 of my ebook soon. \n\nNote: i will talk about these codes in ch15 of ebook Bypassing AVs by C# Programming\n\n### ETWNetMonv3Agent.exe\n\"ETWNetMonv3Agent.exe\" is ETW Agent C# code and with this simple code you can have realtime TCPv4/v6 Connection Logs also with this tool you can Detect Meterpreter Payload via Signature (with switch SCAN , Detection for Remote Thread Injection) But this Signature worked very well only on Msfv4 (tested on Kali 2018, msf v4.17), Metasploit v6 (msf6) signature is changed so this old signature will not work on Msf6 ;)   \n\n### ETWNetMon3Log.exe\n\"ETWNetMon3Log.exe\" is Command base tool for make XML/HTML report via \"Queries\" from ETW Logs (which made by ETWNetMonv3Agent.exe tool).\n\nNote: this code was for (eBook Bypassing AVs by C# Programming, Chapter-15), so i will publish pdf file for Part1 of ch15, and C# code for \"ETWNetMonv3.exe\" will publish with pdf (soon), but  \"ETWNetMonv3Agent.cs\" \u0026 \"ETWNetMon3Log.cs\" Codes are ready and you can use them and both PE files should be in the \"same folder\" because of log file \"EtwNetMonv3logs.txt\". (both codes need to work with this log file, this log file made by Agent \u0026 with ETWNetMon3Log.exe you can make HTML report from this file by simple Queries... , \"for make report with XML/HTML format this ETWNetMon3Log.cs is useful tool for [blue teams \u0026 defenders], [i hope]\".\n\nNote: i will publish new codes + pdf file about this code which is for chapter-15 (ebook: Bypassing Avs by C# Programming) \u0026 Some bugs in the codes will fix (soon). (some bugs are here in code ETWNetMonv3Agent.cs , especially for Scanning Memory, which i need to change code from single thread to Multithreading Code, i knew that but now i am working on other codes \u0026 pdf file for chapter ch15-part1, but i will fix these problems too). \n\n### ETWProcessMon.exe\n\"ETWProcessMon\" is simple tool for Monitoring Processes/Threads/Memory/Imageloads/TCPIP Events via ETW, with this code you can Monitor New Processes also you can See New Threads (Thread Started event) + Technique Detection for Remote-Thread-Injection (Which Means Your New Thread Created into Target Process by Another Process), also with this code you can Monitor VirtualMemAllocation Events in Memory for All Processes (which sometimes is very useful for Payload Detection in-memory) also you can see ImageLoads for each Process \u0026 you can see TCPIP Send Events for each Process too. \n\nNote: VirtualMemAlloc for (Payload-Detection) + ImageLoad \u0026 Remote-Thread-Injection Detection for (Technique-Detection) are useful for Blue Teams/Defenders.\n\nVideo [1], [Video-1 of Chapter15-Part1]: \n\n    ETW + C# and Monitoring Network Connections via ETW (CH15-Part1): \n    link1 =\u003e https://www.youtube.com/watch?v=zDG4Tze9mts\n    link2 =\u003e https://share.vidyard.com/watch/5ybRwUbt2b3d3M3ggQiuYQ\n\nVideo [2], [Video-2 of Chapter15-Part1\u00262]:\n\n    ETW + C# \u0026 Monitoring Process/Memory/Threads + Network Connection via ETW (CH15-Part2):\n    link1 =\u003e https://www.youtube.com/watch?v=1Aeor_NqpUA\n    link2 =\u003e https://share.vidyard.com/watch/6bYvcF75FqQ3BomZELpQUj\n\nVideo [3], [Video-3 of Chapter15-Part2]: (video is about C# + ETW vs Process Hollowing, DInvoke (syscall),Loading dll/functions from Memory,Classic-RemoteThreadInjection)  \n\n    C# + ETW vs Some Thread/Process/Code Injection Techniques (CH15-Part2):\n    link1 =\u003e https://www.youtube.com/watch?v=d1a8WqOvE84\n    link2 =\u003e https://share.vidyard.com/watch/4kB2Xy1bLfhRxaTD6pwaLD\n\n### ETWProcessMon2.exe\nNote: in \"ETWProcessMon2.cs\" (Version 2) NewProcess events + Remote-Thread-Injection Detecetion events + TCPIP send events all will save in Windows Event Log which with EventViewer you can watch them also VirtualMemAlloc events + Remote-thread-injection Detection Events will save in text \"ETWProcessMonlog.txt\" log file too (at the same time). so in this version2 we have two type of Events log files =\u003e 1.\"windows event logs [ETWPM2]\" , 2.\"ETWProcessMonlog.txt\"\n\nETW Events in event log [ETWPM2]:\n\n    [Information] Event ID 1  =\u003e NewProcess event \n    [Warning]     Event ID 2  =\u003e Remote-Thread-Injection Detection event \n    [Information] Event ID 3  =\u003e TCPIP Send event\n\nfor more information about \"ETWProcessMon2.exe\" \u0026 \"ETWPM2Monitor.exe\" (step by step with images \u0026 details) =\u003e https://github.com/DamonMohammadbagher/ETWProcessMon2 \n\n -----------------------------------------------------------    \n \n 1. ETWNetMonv3.exe Windows App (i will publish Code for this tool + pdf Chapter15 soon) \n \n Note: in win10 you should run this tool with Admin (\"Run as Admin\")\n \n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/ETWNetMonv3.png)\n\n -----------------------------------------------------------    \n  \n  2. ETWNetMonv3Agent.cs (ETW Agent) \n  \n  Note: switch SCAN has bugs [not recommanded]  ¯\\_(ツ)_/¯\n \n usage: \n    \n    step1: [win] ETWNetMonv3Agent.exe [SCAN]/[DBG]\n    example: [win] ETWNetMonv3Agent.exe\n    example: [win (Run As Admin)] ETWNetMonv3Agent.exe SCAN\n    Note: you need Run As Admin only for switch SCAN , ETWNetMonv3Agent.exe code with/without [SCAN/DBG] will make log file \"EtwNetMonv3logs.txt\"\n\n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/ETWNetMonv3_02.png)\n\n -----------------------------------------------------------      \n  \n  3. ETWNetMon3Log.cs (Command base tool for make XML/HTML report via \"Queries\" from ETW Log file EtwNetMonv3logs.txt)\n  \n  Note: this file with ETWNetMonv3Agent.exe should be in the same folder (both work with log file EtwNetMonv3logs.txt)\n \n usage: \n    \n    step1: [win] ETWNetMonv3Log.exe  [XML xmlfile.xml] [HTML \"YOUR QUERY\"]\n    example: ETWNetMonv3Log.exe HTML \"state LIKE '*synsent*'\"\n    syntax  1: switch XML, All ETW records from text [EtwNetMonv3logs.txt] will save to xml file (convert all records to xml)\n    example 1: ETWNetMonv3Log.exe XML filename.xml\n    syntax  2: ETWNetMonv3Log.exe HTML \"your query\"\n    example 2: ETWNetMonv3Log.exe html \"rport \u003e=80 OR events LIKE '*Established*' AND events LIKE '*connect complete*'\"\n    example 2: ETWNetMonv3Log.exe html \"events LIKE '*requested to connect*'\"\n    example 2: ETWNetMonv3Log.exe html \"state NOT LIKE '*synsent*'\"\n    example 2: ETWNetMonv3Log.exe html \"events LIKE '*'\"\n    example 2: ETWNetMonv3Log.exe html \"rhost LIKE '192.168*' or lhost LIKE '192.168.1*'\"\n    example 2: ETWNetMonv3Log.exe html \"rport \u003c=80 OR lport \u003e=50000\"\n    example 2: ETWNetMonv3Log.exe html \"pname LIKE '*.exe*'\"\n    example 2: ETWNetMonv3Log.exe html \"events LIKE '*C:\\\\*'\"\n    example 2: ETWNetMonv3Log.exe html \"PID = 1452\"\n    syntax 2-1: ETWNetMonv3Log.exe html2 [MODE 0=SYNSENT , 1=ESTABLISHED] [Query]\n    example 2-1: ETWNetMonv3Log.exe html2  1  \"PID = 1452\");\n    example 2-1: ETWNetMonv3Log.exe html2  0  \"PID = 1452\");\n    example 2-1: ETWNetMonv3Log.exe html2  1  \"rport \u003e= 80\");\n    example 2-1: ETWNetMonv3Log.exe html2  1  \"events LIKE '*192.168*'\"\n        \nNote: for \"syntax 2-1\" or switch \"html2\" these two files =\u003e 1.EtwNetMonv3logs.txt \u0026 2.ETWProcessMonlog.txt should be in current folder, this switch \"html2\" is for integration between log files  [EtwNetMonv3logs.txt \u0026 ETWProcessMonlog.txt], switch \"html\" was only for EtwNetMonv3logs TCPIP Network reports.\n\n### Note: for \"syntax 2-1\" report you need these steps:\n 1. run =\u003e ETWNetMonv3Agent.exe without switch (run as admin is better) ;D (step1)\n 2. run =\u003e ETWProcessMon.exe without switch (run as admin) (step2)\n 3. run =\u003e your own payload injector (meterpreter payload injector for example)\n 4. wait for etw events, sometimes more than 1-2 min needs ;) (depends on systems/vm)\n 5. after 2-3 mins, copy log file \"ETWProcessMonlog.txt for ETWProcessMon.exe to folder which ETWNetMonv3Agent.exe \u0026 EtwNetMonv3logs.log exist.\n 6. run ETWNetMonv3Log.exe with switch \"html2\" + [query] (ETWNetMonv3Log.exe should be in folder step5)\n 7. you will have html report (i hope) ;) , watch videos before run codes, video =\u003e https://share.vidyard.com/watch/4kB2Xy1bLfhRxaTD6pwaLD  \n    \n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/4.png)\n\nETWNetMon3Log.exe + integration with ETWProcessMon.exe log file (EtwNetMonv3logs.txt + ETWProcessMonlog.txt)\n\nNote: in this case you should use switch (html2) like picture in this time you will have some details from ETWProcessMon log file in your report which is Thread-injection \u0026 VirtualMemAlloc for each Process in your TCPIP/Network Connections report (integration between tcpip events \u0026 Process/Mem/Threads Events). as you can see sometimes very simple you can find Meterpreter payload via this information/events. (useful for Blue teams \u0026 Defenders)\n\n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/4-1.png)\n\n -----------------------------------------------------------    \n  4. ETWProcessMon.cs (ETWProcessMon v1.2 tool is for RemoteThreadInjection Detection)\n  \n  Note: \"this code tested for Detection against some new/old methods like C# code for Process Hollowing, DInvoke (syscall), Loading dll/functions from Memory [32BIT], Classic-RemoteThreadInjection, APC Queue Code Injection, Process-Ghosting, Process Hollowing \u0026 Process Doppelganging by [Minjector], ...\"\n\nin these videos you can watch Result of tests:\n  \nDemo Video1: https://www.linkedin.com/posts/damonmohammadbagher_this-video-is-my-research-result-about-using-activity-6809542015475355648-fsfX/ \n\nDemo Video2: https://share.vidyard.com/watch/4kB2Xy1bLfhRxaTD6pwaLD \n \n usage: \n    \n    step1: [win] ETWProcessMon.exe\n    example 1: ETWProcessMon.exe\n    example 2: ETWProcessMon.exe \u003e Save_all_outputs.txt\n    Note: in \"example 2\" you can have all outputs in text file [Imageload/TCPIP/NewProcess/NewThreads events + Injection Detection + Details etc] also at the same time VirMemAlloc events + Injections Detection events saved into log file ETWProcessMonlog.txt too.\n    \n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/1.png)\n--- \n### ETWProcessMon.exe \u0026 Imageload + TCPIP Events\n\n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/2.png) \n\n---\n### ETWProcessMon.exe \u0026 Remote Thread Injection Detection by Log File (ETW Events)\n\n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/etwinj.png)\n\n---\n### ETWProcessMon.exe \u0026 Payload Detection by Log File (ETW Events)\n\n   ![](https://github.com/DamonMohammadbagher/ETWNetMonv3/blob/main/Pic/detection.png)\n -----------------------------------------------------------    \n\n    \n    \n    \n\u003cp\u003e\u003ca href=\"https://hits.seeyoufarm.com\"\u003e\u003cimg src=\"https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2FDamonMohammadbgher%2FETWNetMonv3\"/\u003e\u003c/a\u003e\u003c/p\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdamonmohammadbagher%2Fetwnetmonv3","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdamonmohammadbagher%2Fetwnetmonv3","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdamonmohammadbagher%2Fetwnetmonv3/lists"}