memory-forensics

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

pe-format hooking pe-dumper pe-analyzer libpeconv process-analyzer scans anti-malware pe-sieve malware-analysis memory-forensics

C++ 3.43 k

8 天前

hasherezade / hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

pe-sieve anti-malware malware-analysis malware-detection memory-forensics

C 2.22 k

2 天前

stuxnet999 / MemLabs

Educational, CTF-styled labs for individuals interested in Memory Forensics

forensics dfir memory-forensics Windows ctf ctf-challenges digital-forensics 安全 Cybersecurity

Shell 1.76 k

5 年前

microsoft / avml

AVML - Acquire Volatile Memory for Linux

Rust memory-forensics linux-security

Rust 989

7 天前

hasherezade / mal_unpack

Dynamic unpacker based on PE-sieve

libpeconv pe-sieve memory-forensics malware-unpacker malware-analysis

C 754

2 天前

LETHAL-FORENSICS / MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

PowerShell incident-response dfir digital-forensics memory-forensics

PowerShell 674

2 个月前

swwwolf / wdbgark

WinDBG Anti-RootKit Extension

kernel-mode C++Malware malware-analysis malware-research forensic-analysis windbg windbg-extension anti-rootkit Windows Visual Studio driver memory-forensics anomaly-detection user-mode debugging-tool

C++ 636

5 年前

teamdfir / sift

SIFT

forensics sans memory-forensics saltstack 命令行界面 Amazon Web Services cast

517

2 年前

patois / IDACyber

Data Visualization Plugin for IDA Pro

ida cyber 数据可视化 ida-pro idapython-plugin 逆向工程 memory-hacking Pixel Art color-filter memory-forensics firmware-analysis exploitation

Python 295

3 年前

cado-security / varc

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

Amazon Web Services aws-fargate aws-lambda cloud-security dfir dfir-automation forensics memory-forensics aws-forensics docker-forensics 安全 Hacktoberfest

Python 256

10 个月前

LETHAL-FORENSICS / Collect-MemoryDump

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

PowerShell dfir digital-forensics incident-response memory-forensics

PowerShell 248

6 个月前