#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
squalr/squalrA generic game/software hacking tool written from the ground up in Rust.
kkent030315/pagetableinjectionCode Injection, Inject malicious payload via pagetables pml4.
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
ccob/beaconeyeHunts out CobaltStrike beacons and logs operator command output
codewhitesec/handlekatzPIC-based Lsass memory dumper using cloned handles to evade detection, producing obfuscated dumps with minimal memory footprint for red team…
theflink/deepsleepA variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
crossc2/crossc2kitCrossC2 developed based on the Cobalt Strike framework can be used for other cross-platform system control. CrossC2Kit provides some interfaces for…
liamg/dismember:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.
sf197/memoryshellhunterJava Agent memory horse scanner combined with Call Graph modus
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
advanced-threat-research/dotdumperAn automatic unpacker and logger for DotNet Framework targeting files
kyleavery/aceldrCobalt Strike UDRL for memory scanner evasion.
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
xuanxuan0/tietwagentPoC memory injection detection agent based on ETW, for offensive and defensive research purposes
sterrasec/ipa-meditMemory modification tool for re-signed ipa supports iOS apps running on iPhone and Apple Silicon Mac without jailbreaking.
dwmetz/cyberpipeAn easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.
