
volatility
An advanced memory forensics framework

An advanced memory forensics framework

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…

List of Awesome CobaltStrike Resources

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

Portable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…

Scan files or process memory for CobaltStrike beacons and parse their configuration

Cross-platform memory dumper using Frida to extract accessible memory from iOS, Android, and Windows applications for forensic analysis and…

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

Collection of forensic tools


Callstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…

:knife: Scan memory for secrets and more. Maybe eventually a full /proc toolkit.

mXtract - Memory Extractor & Analyzer

A centralized and enhanced memory analysis platform