breppo / Volatility-BitLocker
Volatility plugin to retrieve the Full Volume Encryption Key in memory. The FVEK can then be used with the help of Dislocker to mount the volume.
☆35Updated 4 years ago
Related projects ⓘ
Alternatives and complementary repositories for Volatility-BitLocker
- Windows symbol tables for Volatility 3☆73Updated 4 months ago
- volatility explorer☆90Updated 4 years ago
- Memory mapping profiles for forensic analysis using volatility 3☆24Updated 2 years ago
- Volatility Symbol Generator for Linux Kernels☆31Updated last year
- A small util to brute-force prefetch hashes☆73Updated 2 years ago
- Volatility plugin to extract BitLocker Full Volume Encryption Keys (FVEK)☆62Updated 3 years ago
- ☆55Updated last month
- Linpmem is a linux memory acquisition tool☆74Updated 6 months ago
- ☆68Updated 2 years ago
- Yara Rules for Modern Malware☆67Updated 8 months ago
- A collection of tools and detections for the Sliver C2 Frameworj☆109Updated last year
- VBScript & VBA source-to-source deobfuscator with partial-evaluation☆73Updated 3 months ago
- Volatility3 plugins developed and maintained by the community☆45Updated last year
- AdHoc solutions☆48Updated last year
- bootloaders.io is a curated list of known malicious bootloaders for various operating systems. The project aims to assist security profes…☆48Updated last year
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆220Updated 8 months ago
- Powershell Linter☆46Updated last month
- runsc loads 32/64 bit shellcode (depending on how runsc is compiled) in a way that makes it easy to load in a debugger. This code is base…☆36Updated last year
- ☆91Updated last year
- A small utility to translate NTDS.dit files to SQLite format.☆62Updated last year
- This aims to be a collection of tools to forensically analyze Active Directory databases☆20Updated 2 weeks ago
- Lazarus analysis tools and research report☆55Updated 11 months ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆194Updated last year
- Tools that trigger False Positive AV alerts☆43Updated last year
- Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles☆147Updated last month
- 64bit Windows 10 shellcode that injects all processes with Meterpreter reverse shells.☆127Updated last year
- ☆53Updated last year
- Manipulate timestamps on NTFS☆49Updated 10 years ago
- Some scripts to support with importing large datasets into BloodHound☆78Updated 11 months ago
- Emulate and Dissect MSF and *other* attacks☆139Updated 8 months ago