DetectWindowsCopyOnWriteForAPI

(★ 200)

Enumerate various traits from Windows processes as an aid to threat hunting

File Explorer

- d-alpc-callbacks.cpp
- d-alpc-callbacks.vcxproj
- d-alpc-callbacks.vcxproj.filters
- Engine.cpp
- Engine.h
- stdafx.h
- d-apc-callbacks.cpp
- d-apc-callbacks.vcxproj
- d-apc-callbacks.vcxproj.filters
- Engine.cpp
- d-cow.cpp
- d-cow.sln
- d-cow.vcxproj
- d-cow.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- XGetopt.cpp
- XGetopt.h
- d-criticalsections.cpp
- d-criticalsections.vcxproj
- d-criticalsections.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-dr-registers.cpp
- d-dr-registers.vcxproj
- d-dr-registers.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-nonmodulecallstack.cpp
- d-nonmodulecallstack.vcxproj
- d-nonmodulecallstack.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-peb-dll-loadreason.cpp
- d-peb-dll-loadreason.vcxproj
- d-peb-dll-loadreason.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-teb.cpp
- d-teb.vcxproj
- d-teb.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-thread-start.cpp
- d-thread-start.vcxproj
- d-thread-start.vcxproj.filters
- Engine.cpp
- Engine.h
- README.md
- stdafx.h
- d-vehimplant.cpp
- d-vehimplant.vcxproj
- d-vehimplant.vcxproj.filters
- Engine.cpp
- Engine.h
- InternalStructs.h
- README.md
- stdafx.h
- d-vehlab.vcxproj
- d-vehmisuse.cpp
- d-vehmisuse.vcxproj.filters
- Engine.cpp
- Engine.h
- InternalStructs.h
- README.md
- stdafx.h
.gitignore
LICENSE
README.md

1. Get the code

git clone https://github.com/nccgroup/DetectWindowsCopyOnWriteForAPI

Downloads the entire project code from GitHub to your computer.

cd DetectWindowsCopyOnWriteForAPI

Moves into the project folder you just downloaded.

Medium Recommended

Prerequisites

cd d-cow

This project's files live in a subfolder, so move into it first.

dotnet restore

Downloads the packages the project depends on.

dotnet run

Builds the project and runs it immediately.

✅ After dotnet run, check the message or address shown in the terminal.