meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
lethal-forensics/collect-memorydumpAutomated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
marcosd4h/memhunterLive hunting of code injection techniques
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
0vercl0k/clairvoyanceVisualize the virtual address space of a Windows process on a Hilbert curve.
kd8bny/limeaideA python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.
blueteam0ps/memoptixA Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.
antisurveillanceagency/shadownetShadowNet is an anonymous routing protocol that forces all connections (system-wide) to go through Tor while implementing Mixnet-like…
withsecurelabs/volatility-pluginsVolatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.
mister-turtle/cve-2023-32784Extracts KeePass master passwords from memory dumps of unlocked databases, outputting potential characters by position, a passphrase, and a…
amperclock/cve-2023-32784-kdbxpassdmpRetrieves the master password from Keepass memory dump, using a hint of bruteforce.
dawnl3ss/cve-2023-32784Retrieve the master password of a keepass database <= 2.53.1
habanada/nativemirrorNative Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.
