
oletools
Python toolkit for analyzing MS OLE2 and Office documents, extracting VBA macros, detecting exploits, and performing forensic analysis of structured…

Python toolkit for analyzing MS OLE2 and Office documents, extracting VBA macros, detecting exploits, and performing forensic analysis of structured…

Community-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…

Hunts out CobaltStrike beacons and logs operator command output

Volatility plugin for extracts configuration data of known malware

Configuration Extractors for Malware

A python script developed to process Windows memory images based on triage type.

Extract AutoIt scripts embedded in PE binaries

Volatility 3 ported to Rust. Same output, much faster.

A python library to parse OneNote (.one) files

Incident Response - Fast suspicious file finder

volatility explorer (volatility 2)

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

A ProcessMonitor visualization application written in rust.

Tools for the Computer Incident Response Team :computer:

Volatility Explorer Suit (volatility 3)

Live memory analysis tool for detecting reflectively loaded .NET DLLs by scanning process memory regions for abnormal flags, page types, and PE…

Native YARA scanner X-Tension for X-Ways Forensics, enabling in-snapshot file scanning with multi-threaded RVS support, report table output, and no…

Collection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…