

Curated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…

Offset Independent Credential Extraction Tool

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Volatility 3 ported to Rust. Same output, much faster.

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

ShadowNet is an anonymous routing protocol that forces all connections (system-wide) to go through Tor while implementing Mixnet-like…

An advanced memory forensics framework

A centralized and enhanced memory analysis platform

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…

Portable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…

List of Awesome CobaltStrike Resources

Retrieves the master password from Keepass memory dump, using a hint of bruteforce.

Simple Process Dumper using DMA over a PCIe FPGA device

Frida-based tool that ports Cheat Engine's MonoDataCollector to Android and iOS, enabling runtime Mono/IL2CPP data collection and memory inspection…

Collection of forensic tools