Archived
volatility
volatilityfoundation/volatilityAn advanced memory forensics framework
digital-forensicsforensicsincident-response+4
volatilityfoundation/volatilityAn advanced memory forensics framework
cristianzsh/forensictoolsCollection of forensic tools
k1nd0ne/volwebA centralized and enhanced memory analysis platform
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
marcosd4h/memhunterLive hunting of code injection techniques
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
rastrea2r/rastrea2rCollecting & Hunting for IOCs with gusto and style
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
lethal-forensics/collect-memorydumpAutomated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…
ajmartel/irtriageIncident Response Triage - Windows Evidence Collection for Forensic Analysis
blueteam0ps/memoptixA Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
