Alternatives and similar repositories for WinPmem

Users that are interested in WinPmem are comparing it to the libraries listed below

• LETHAL-FORENSICS / MemProcFS-Analyzer
  MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
  ☆674Updated last month
• keydet89 / RegRipper3.0
  RegRipper3.0
  ☆640Updated 9 months ago
• magicsword-io / LOLDrivers
  Living Off The Land Drivers
  ☆1,281Updated 3 weeks ago
• mandiant / capa-rules
  Standard collection of rules for capa: the tool for enumerating the capabilities of programs
  ☆631Updated last week
• ANSSI-FR / bmc-tools
  RDP Bitmap Cache parser
  ☆565Updated 7 months ago
• CERT-Polska / drakvuf-sandbox
  DRAKVUF Sandbox - automated hypervisor-level malware analysis system
  ☆1,200Updated this week
• DissectMalware / XLMMacroDeobfuscator
  Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)
  ☆584Updated last year
• 0xrawsec / whids
  Open Source EDR for Windows
  ☆1,274Updated 2 years ago
• nasbench / EVTX-ETW-Resources
  Event Tracing For Windows (ETW) Resources
  ☆397Updated 11 months ago
• omerbenamram / evtx
  A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
  ☆794Updated 3 weeks ago
• persistence-info / persistence-info.github.io
  ☆507Updated last year
• forrest-orr / moneta
  Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
  ☆773Updated last year
• sophoslabs / IoCs
  Sophos-originated indicators-of-compromise from published reports
  ☆631Updated last month
• EricZimmerman / PECmd
  Prefetch Explorer Command Line
  ☆269Updated 8 months ago
• thewhiteninja / ntfstool
  Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
  ☆538Updated 2 years ago
• reversinglabs / reversinglabs-yara-rules
  ReversingLabs YARA Rules
  ☆850Updated 3 weeks ago
• airbus-cert / Winshark
  A wireshark plugin to instrument ETW
  ☆569Updated 3 years ago
• chronicle / GCTI
  ☆551Updated last year
• hasherezade / mal_unpack
  Dynamic unpacker based on PE-sieve
  ☆754Updated this week
• EricZimmerman / LECmd
  Lnk Explorer Command line edition!!
  ☆323Updated 8 months ago
• strontic / xcyclopedia
  Encyclopedia for Executables
  ☆452Updated 3 years ago
• wietze / HijackLibs
  Project for tracking publicly disclosed DLL Hijacking opportunities.
  ☆806Updated last month
• ScarredMonk / SysmonSimulator
  Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…
  ☆854Updated 3 years ago
• wavestone-cdt / EDRSandblast
  ☆1,714Updated last year
• wagga40 / Zircolite
  A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
  ☆742Updated 5 months ago
• MBCProject / mbc-markdown
  MBC content in markdown
  ☆475Updated 3 months ago
• EricZimmerman / KapeFiles
  This repository serves as a place for community created Targets and Modules for use with KAPE.
  ☆763Updated this week
• zeronetworks / rpcfirewall
  ☆523Updated 3 months ago
• EricZimmerman / evtx
  C# based evtx parser with lots of extras
  ☆324Updated 2 weeks ago
• elastic / protections-artifacts
  Elastic Security detection content for Endpoint
  ☆1,286Updated this week