Memory Forensics

alex3434/wmi-static-spoofer

Spoofing the Windows 10 HDD/diskdrive serialnumber from kernel without hooking

hasherezade/mal_unpack

Dynamic unpacker based on PE-sieve

rek7/mxtract

mXtract - Memory Extractor & Analyzer

maldev-academy/dumpbrowsersecrets

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from…

volatilityfoundation/community

Community-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…

theflink/deepsleep

A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC

0x36/pixel_gpu_exploit

Android 14 kernel exploit for Pixel7/8 Pro

bert-janp/incident-response-powershell

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

ccob/beaconeye

Hunts out CobaltStrike beacons and logs operator command output

jpcertcc/malconfscan

Volatility plugin for extracts configuration data of known malware

vdohney/keepass-password-dumper

Original PoC for CVE-2023-32784

diogo-fernan/ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

vah13/extracttvpasswords

tool to extract passwords from TeamViewer memory using Frida

apr4h/cobaltstrikescan

Scan files or process memory for CobaltStrike beacons and parse their configuration

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

theflink/hunt-sleeping-beacons

Callstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…

pandaadir05/ghost

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…

magnetforensics/swishdbgext

Incident Response & Digital Forensics Debugging Extension