monnappa22 / HollowFindLinks
Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect and divert the forensic analysis techniques. The plugin detects such attacks by finding discrepancy in the VAD and PEB, it also disassembles the address of entry point to detect any redirection attempts and als…
☆141Updated 3 years ago
Alternatives and similar repositories for HollowFind
Users that are interested in HollowFind are comparing it to the libraries listed below
Sorting:
- ☆84Updated 5 years ago
- Pure Python parser for Application Compatibility Shim Databases (.sdb files)☆108Updated 4 years ago
- YARA rules for use with ProcFilter☆87Updated 8 years ago
- ☆135Updated 6 years ago
- A tool for de-obfuscating PowerShell scripts☆71Updated 6 years ago
- Various Yara signatures (possibly to be included in a release later).☆87Updated 6 years ago
- Lazy Office Analyzer☆122Updated 8 years ago
- Generating YARA rules based on binary code☆216Updated 4 years ago
- c2 traffic☆191Updated 2 years ago
- Automatic YARA rule generation for Malpedia☆162Updated 3 years ago
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆120Updated last year
- Smart DLL execution for malware analysis in sandbox systems☆144Updated 10 years ago
- Various scripts for different malware families☆106Updated 4 years ago
- BinSequencer is a script designed to find a common pattern of bytes within a set of samples and generate a YARA rule from the identified…☆78Updated 3 years ago
- An advanced memory forensics framework☆96Updated 6 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆77Updated 10 years ago
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆37Updated 9 years ago
- PE Import Hash Generator☆79Updated 8 years ago
- Miscellaneous Malware RE☆196Updated 3 years ago
- Static based decoders for malware samples☆94Updated 5 years ago
- Cuckoo running in a nested hypervisor☆128Updated 5 years ago
- ☆97Updated 5 years ago
- ConventionEngine - A Yara Rulepack for PDB Path Hunting☆37Updated 2 years ago
- A taxonomy and dictionary of malware behaviors.☆43Updated 6 years ago
- Various config files obtained during malware analysis☆67Updated 6 years ago
- Live hunting of code injection techniques☆383Updated 6 years ago
- Automated malware unpacker☆120Updated 9 years ago
- Telsy CTI Research Team☆57Updated 4 years ago
- Process Spawn Control is a Powershell tool which aims to help in the behavioral (process) analysis of malware. PsC suspends newly launche…☆264Updated 3 years ago
- Handy scripts to speed up malware analysis☆35Updated 2 years ago