12 lines (6 loc) · 380 Bytes

Detect_remote_thread

A kernel driver that detects remote thread creation and dumps the shellcode injected.

Usage:

injection_detection_user.exe 1 PATH to set the path where the shellcodes are saved.
injection_detection_user.exe 0 to start dumping shellcodes.

NOTE: I will update the code with more comments and a better readme when I have some free time.