fibratus
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
defensive-toolsforensicsincident-response+3
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
hasherezade/libpeconvCustom PE loading and manipulation library for manual mapping, IAT hooking, memory dumping, and rebuilding imports for malware analysis and reverse…
volatilityfoundation/communityCommunity-maintained Volatility plugin collection for memory forensics, extending memory dump analysis with modules for malware and process…
ccob/beaconeyeHunts out CobaltStrike beacons and logs operator command output
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
marcosd4h/memhunterLive hunting of code injection techniques
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
forrest-orr/artifacts-kitPseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
bohops/rogueassemblyhunterRogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
memoryforensics1/volexpvolatility explorer (volatility 2)
opensourcesec/cirtkitTools for the Computer Incident Response Team :computer:
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
memoryforensics1/vol3xpVolatility Explorer Suit (volatility 3)
mayhamad/memtracerLive memory analysis tool for detecting reflectively loaded .NET DLLs by scanning process memory regions for abnormal flags, page types, and PE…