cortex

CORTEX v1.0.1 - INSTALLATION AND QUICK START Cortex v1.0.1 ships as a single portable Windows application: cortex.exe. The x64 and x86 instrumentation runtimes live in the runtime folder and are selected automatically for each target. Nothing else has to be installed no Qt, no Visual C++ runtime...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

volatility-plugins

https://www.countercept.com/blog/hunting-for-gargoyle-memory-scanning-evasion/...

mnemosyne

Mnemosyne is a generic Windows-based memory scraping tool. It scans a process memory space for a search string or regex unicode and ascii then if found, spits these out either to stdout, a file or a socket to a remote listener. The utility is useful for memory scraping a process, as a...

dotnet-gargoyle

dotnet-gargoyle A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique https://www.countercept.com/blog/gargoyle-memory-scanning-evasion-for-net/...

RustChain

Description This tool is a simple PoC of how to hide memory artifacts using a ROP chain in combination with hardware breakpoints. The ROP chain will change the main module memory page's protections to N/A while sleeping i.e. when the function Sleep is called. For more detailed information about...

antipwny

antipwny Authors: Rohan Vazarkar, David Bitner A host based IDS/IPS written in C, targeted at Metasploit Payloads. Instructions AntiPwny requires .NET Framework 4.5, which can be acquired here. An offline installer is available here http://www.microsoft.com/en-us/download/details.aspx?id=40779...

anticuckoo

anticuckoo A tool to detect and crash Cuckoo Sandbox. Tested in Cuckoo Sandbox Official and Accuvant's Cuckoo version. Please, consider make a donation: https://github.com/sponsors/therealdreg Anticuckoo can also detect other sandbox like FireEye -c2: Reddit / netsec discussion about anticuckoo...

xwf-yara-scanner

Overview This X-Ways Forensics X-Tension allows the use of YARA within X-Ways natively. It uses both the X-Ways Forensics API and the YARA API to achieve this. Note: This is an open source project, not a formal CrowdStrike product. There are many benefits to running YARA within X-Ways, versus...

cve_2023_38831_scanner

CVE-2023-38831 Scanner Overview The CVE-2023-38831 Scanner is an advanced cybersecurity tool designed to detect and analyze the presence of the CVE-2023-38831 vulnerability in WinRAR installations. This project implements a multi-layered approach to vulnerability detection, incorporating file...

mXtract

mXtract mXtract is an opensource linux based tool that analyzes and dumps memory. It is developed as a pentration testing tool, its primary purpose is to scan memory for private keys, ips, and passwords using regexes. Remember, your results are only as good as your regexes. Screenshots Scan with...

fibratus

Fibratus Sensor de seguridad para la detección y protección de amenazas en tiempo real Comenzar » Documentación • Reglas • Filaments • Descargas • Debates Fibratus detecta y erradica tácticas avanzadas de atacantes, malware y amenazas emergentes al examinar y contrastar un amplio espectro de...

aes-finder

AES Finder Utilidad para encontrar claves AES en la memoria de procesos en ejecución. Funciona para claves de 128, 192 y 256 bits. Uso Abra la solución aes-finder.sln en Visual Studio 2013 para compilar el código fuente. Alternativamente, use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer...

dismember

🔪 Dismember Dismember es un conjunto de herramientas de línea de comandos para Linux que se puede utilizar para escanear la memoria de todos los procesos o de algunos específicos en busca de secretos comunes y expresiones regulares personalizadas, entre otras cosas. Eventualmente se convertirá en...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUERIDO -m |region|referenced|ioc -p |PID OPCIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

PT-2026-98818

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 and 6.18 LTS Description An issue exists in the drm/virtio component where the virtio-gpu driver fails to correctly use the DMA API for resource backing on Xen PV domains. In these domains, page addresses do not...

CVE-2026-64289

A flaw was found in the Linux kernel. In the iommufd component, the iommufdhwptinvalidate function allows a local user to provide excessively large values for entrynum and entrylen during cache invalidation. This can lead to a Denial of Service DoS by causing the system to become unresponsive...

📄 Abacre Restaurant Point of Sale 15.0.0.1656 Memory Scanner

Abacre Restaurant Point of Sale version 15.0.0.1656 memory scanner for sensitive data detection. This Python script is an advanced Windows memory scanning tool designed to detect sensitive data leaks within running processes. It performs deep memory analysis to identify patterns resembling produc...

EUVD-2005-1713

Malware in sbrugna...

RX-INT: a Kernel Engine for Real-Time Detection and Analysis of In-Memory Threats

Malware and cheat developers use fileless execution techniques to evade traditional, signature-based security products. These methods include various types of manual mapping, module stomping, and threadless injection which work entirely within the address space of a legitimate process, presenting...