8 matches found
avml
AVML 为 Linux 获取易失性内存 概述 一个用于 Linux 的便携式易失性内存获取工具。 AVML 是一款用 Rust 编写的 X8664 用户态易失性内存获取工具，旨在以静态二进制形式部署。AVML 无需预先了解目标操作系统的发行版或内核即可获取内存。无需在目标上进行编译或指纹识别。 功能特性 通过 Azure Blob Store 或 HTTP PUT 将捕获的镜像保存到外部位置 Azure Blob Storage 上传会通过 Azure SDK 的默认指数退避策略重试瞬时故障（8 次尝试，总耗时上限为一分钟）。 使用 Snappy 进行可选的分页级压缩。 使用 LiME...
memory-forensic
memory-forensic 一款内存取证工具包，可自行对 Windows 内核进行画像——并逐进程与 Volatility 3 交叉校验。 mem4n6 读取所有常见转储格式（LiME、AVML、ELF core、Windows 崩溃转储、休眠文件、VMware 保存状态、kdump、raw…），并遍历进程、线程、模块、网络连接和注入内存——这一切来自一个静态二进制 ：编译一次，随处复制；无需 Python、无需运行时、无需预置符号目录 。在 Windows 上，它会自行构建 profile：在物理内存中定位 ntoskrnl，从 CodeView 记录中读取其 PDB...
CISA Develops Factsheet for Free Tools for Cloud Environments
CISA has developed and published a factsheet, Free Tools for Cloud Environments, to help businesses transitioning into a cloud environment identify proper tools and techniques necessary for the protection of critical assets and data security. Free Tools for Cloud Environments provides network...
Finding Evil in Windows 10 Compressed Memory, Part Three: Automating Undocumented Structure Extraction
This is the final post in the three-part series: Finding Evil in Windows 10 Compressed Memory. In the first post Volatility and Rekall Tools, the FLARE team introduced updates to both memory forensic toolkits. These updates enabled these open source tools to analyze previously inaccessible...
Rekall - Rekall Memory Forensic Framework
The Rekall Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but...
Rekall Memory Forensic Framework
Rekall is an advanced forensic and incident response framework. While it began life purely as a memory forensic framework, it has now evolved into a complete platform. Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and op...
Dissecting the ZeroAccess Rootkit
The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access t...