
MalConfScan
Volatility plugin for extracts configuration data of known malware

Volatility plugin for extracts configuration data of known malware

Telegram intelligence collection tool for researchers and investigators. Scrapes groups, messages, media, and user data with OCR, Elasticsearch…

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

Extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers

Visualize the virtual address space of a Windows process on a Hilbert curve.

A tool for processing a lot of pcaps using tshark

This project is now part of @mitmproxy.

Extract indicators of compromise from text, including "escaped" ones.

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

A python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.

Script to parse Aircrack-ng captures into a SQLite database and extract useful information like handshakes, MGT identities, interesting relations…

Artifact collection tool for *nix systems

An forensics tool to help aid in the investigation of spoofed emails based off the email headers.

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

Wireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…

A DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.

A tool that removes traces of executed applications on Windows OS.

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.