#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
qeeqbox/analyzerAnalyze, extract and visualize features, artifacts and IoCs of files and memory dumps (Windows, Linux, Android, iPhone, Blackberry, macOS binaries,…
cryptolok/crykexLinux Memory Cryptographic Keys Extractor
dsnezhkov/zombieantZombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.
neo23x0/loki-rs🐍 High-performance, multi-threaded YARA & IOC scanner
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
kudaes/shelterROP-based sleep obfuscation to evade memory scanners
tastypepperoni/pplbladeBypasses PPL protection to dump LSASS process memory, obfuscates dump files with XOR, and exfiltrates them remotely via RAW or SMB without writing to…
strongcourage/uafuzzBinary-level directed fuzzer specialized in detecting Use-After-Free vulnerabilities via ordering-aware input metrics and static analysis, enabling…
jeanextreme002/pymemoryeditorA pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .
denandz/lpc_sniffer_tpmA low pin count sniffer for ICEStick - targeting TPM chips
rainbowdynamix/ghostkatzDump LSASS via physical memory read primitives in vulnerable kernel drivers
antoniococo/malseclogonA little tool to play with the Seclogon service
arinerron/heaptracehelps visualize heap operations for pwn and debugging
rastrea2r/rastrea2rCollecting & Hunting for IOCs with gusto and style
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
nccgroup/asatoolsMain repository to pull all NCC Group Cisco ASA-related tool projects.
