Loki
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
anomaly-detectiondigital-forensicsdisk-forensics+11
3.8k
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
devzinh/ghosttraceRead-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…
adem-hosni/mappedimagesdetectorLightweight native Windows memory scanner for AV/EDR platforms, detecting suspicious mapped images and manual DLL injection techniques by IAT thunk
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
kyleavery/aceldrCobalt Strike UDRL for memory scanner evasion.
t-tani/yama-devYet Another Memory Analyzer for malware detection
gmh5225/frida-meditCross-platform CUI process memory scanner built on Frida for finding, filtering, patching, and dumping live process memory during reverse engineering…
franksec42/mongobleed-exploit-cve-2025-14847Explot, Lab, Scanner - external and docker container, for SMongobleed-CVE-2025-14847 plus phoenix security uploader
sho-luv/mongobleedCVE-2025-14847 (MongoBleed) scanner and exploit tool. Unauthenticated MongoDB heap memory leak via zlib decompression. Detection, memory extraction,…
kashithecomfy/comfyengineComfyEngine is a memory exploration toolkit built for people who need to monitor, patch, and script a running process.
yezzfusl/cve_2023_38831_scannerThis Python application scans for the CVE-2023-38831 vulnerability in WinRAR.
nccgroup/memscanSearches for strings, regex, credit card numbers of magnetic stripe card tracks in a Windows process's memory space
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
neo23x0/loki-rs🐍 High-performance, multi-threaded YARA & IOC scanner
mandiant/flare-vmA collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
alessandroz/lazagneCross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…