Vol3xp

Vol3xp, Volatility 3 Explorer Plugins WinObj - Windows Kernel Objects Explorer an improve of https://github.com/kslgroup/WinObj for volatility 3 winobj.py WinObj very similar to WinObj sysinternals Also supports Struct Analyzer and WinObjGui from VolExp. RAMMap - Physical Address Mapping pfn.py...

MalConfScan

Concept MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

memhunter

Memhunter Caza automatizada de malware residente en memoria a escala Este proyecto está EN DESARROLLO. Espere cambios de funcionalidad y lanzamientos binarios en las próximas semanas. Resumen Memhunter es una herramienta de sensor de endpoint especializada en detectar malware residente, mejorando...

power-tracks-research

Investigación de Power Tracks Repositorio de investigación integral para las mecánicas de mercado de "Power Tracks", "Stock Galaxy" y "Warped Prism". Este código contiene las herramientas, canalizaciones y conjuntos de validación utilizados para descubrir y mapear anomalías sistémicas en la...

LiMEaide

LiMEaide v2.0 by Daryl Bennett - kd8bnyatgmaildotcom About LiMEaide is a python application designed to remotely or locally dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote...

lmg

Linux Memory Grabber A script for dumping Linux memory and creating VolatilityTM profiles. Hal Pomeranz [email protected], 2020-02-01 THANKS! "If I have seen further it is by standing on the shoulders of giants." Issac Newton There are a lot of people who deserve thanks for making this simpl...

lmg

Linux Memory Grabber Un script para volcar la memoria de Linux y crear perfiles de VolatilityTM. Hal Pomeranz [email protected], 2020-02-01 ¡AGRADECIMIENTOS! "Si he visto más lejos es por estar sobre los hombros de gigantes." Issac Newton Hay muchas personas que merecen agradecimiento por...

VolWeb

Introduction VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. 🧬 Objectives The goal of VolWeb is to enhance the efficiency of memory collection and forensic analysis by...

Syd

Syd - Asistente de pruebas de penetración sin conexión Syd es un asistente de pruebas de penetración aislado que analiza salidas de escaneo utilizando LLMs locales y generación aumentada por recuperación. Se ejecuta completamente en tu portátil sin necesidad de conectividad a Internet ni claves...

vol-rs

vol-rs A port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints the same output, byte for byte, a good deal faster. License This project is a port of Volatility 3 and is therefore an...

volatility3

Volatility 3: El framework de extracción de memoria volátil Volatility es el framework más utilizado en el mundo para extraer artefactos digitales de muestras de memoria volátil RAM. Las técnicas de extracción se realizan de forma completamente independiente del sistema investigado, pero ofrecen...

avml

AVML Acquire Volatile Memory for Linux Summary A portable volatile memory acquisition tool for Linux. AVML is an X8664 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distributi...

VolExp

VolExp Volatility Explorer This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access...

volatility-gui

Volatility GUI This is a GUI for Volatility forensics tool written in PyQT5 Prerequisites: 1- Installed version of Volatility. 2- Install PyQT5. sudo apt-get install python3-pyqt5 3- Download Volatility GUI. Configuration From the downloaded Volatility GUI, edit config.py file to specify 1- Pytho...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

linux_screenshot_xwindows

Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...

linux_screenshot_xwindows

Introducción El objetivo de este plugin de volatilidad es extraer una captura de pantalla de todas las ventanas X abiertas a partir de un volcado de memoria. Trabajo previo El plugin de volatilidad linuxxwindows realizado por Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extrae vari...

memory-forensic

memory-forensic A memory forensics toolkit that profiles Windows kernels itself — and is cross-checked, process-for-process, against Volatility 3. mem4n6 reads every common dump format LiME, AVML, ELF core, Windows crash dumps, hibernation files, VMware save-states, kdump, raw… and walks processe...

community

community Volatility plugins developed and maintained by the community. See the README file inside each author's subdirectory for a link to their respective GitHub profile page where you can find usage instructions, dependencies, license information, and future updates for the plugins. usage 1. G...