Idapython script to carve binary for internal RPC structures

RpcView is a free tool to explore and decompile Microsoft RPC interfaces

Generates YARA rules to detect malware using API hashing

Volatility 3.0 development

PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.

Windows process injection methods

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

Driver loader for bypassing Windows x64 Driver Signature Enforcement

Hook system calls, context switches, page faults and more.

Helper library for x86 programs that runs under WOW64 layer on x64 versions of Microsoft Windows operating systems.

awesome-windows-security-development

Windows Research Kernel

Detects code differentials between executables in disk and the corresponding processes/modules in memory