Velocidex / WinPmemLinks
The multi-platform memory acquisition tool.
☆818Updated last month
Alternatives and similar repositories for WinPmem
Users that are interested in WinPmem are comparing it to the libraries listed below
Sorting:
- Living Off The Land Drivers☆1,240Updated last month
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆663Updated 2 weeks ago
- RegRipper3.0☆628Updated 7 months ago
- Standard collection of rules for capa: the tool for enumerating the capabilities of programs☆613Updated 3 weeks ago
- DRAKVUF Sandbox - automated hypervisor-level malware analysis system☆1,167Updated this week
- RDP Bitmap Cache parser☆554Updated 6 months ago
- A Fast (and safe) parser for the Windows XML Event Log (EVTX) format☆781Updated 3 weeks ago
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆583Updated last year
- ☆1,682Updated 11 months ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆764Updated last year
- Dynamic unpacker based on PE-sieve☆746Updated 2 months ago
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆734Updated 4 months ago
- Elastic Security detection content for Endpoint☆1,250Updated this week
- Encyclopedia for Executables☆448Updated 3 years ago
- Open Source EDR for Windows☆1,261Updated 2 years ago
- Sophos-originated indicators-of-compromise from published reports☆607Updated last week
- ☆500Updated last year
- Event Tracing For Windows (ETW) Resources☆393Updated 10 months ago
- Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks,…☆2,204Updated 2 months ago
- Parses $MFT from NTFS file systems☆255Updated 3 months ago
- Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detection…☆852Updated 3 years ago
- ☆547Updated last year
- MBC content in markdown☆469Updated last month
- ReversingLabs YARA Rules☆837Updated last month
- ☆2,124Updated 2 years ago
- Forensics tool for NTFS (parser, mft, bitlocker, deleted files)☆530Updated 2 years ago
- Collection of private Yara rules.☆363Updated 2 weeks ago
- C# based evtx parser with lots of extras☆317Updated last month
- An Active Defense and EDR software to empower Blue Teams☆1,282Updated last year
- Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts…☆1,024Updated 3 weeks ago