hasherezade/process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

↗ Open on GitHub

Stars

699

Forks

119

Language

C

License

MIT

Last push

2 years ago

C pe-injector pefile pe-injection

No related intel yet

This repo has not appeared in any of the sources the radar tracks. The collector runs on a schedule — check back once it covers this repo.