awesome-game-security
Section: Anti Cheat
FreshScore 90
Entry
Volatility 3
Appears in 5 awesome lists
The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing…
Open github.comvolatilityfoundation/volatility3
Found in these lists
Awesome Incident Response
Section: Memory Analysis Tools · The volatile memory extraction framework (successor of Volatility)
FreshScore 89
Awesome Reverse Engineering
Section: Malware analysis · Memory forensics framework for extracting processes, modules, network connections, and other artifacts from memory images.
FreshScore 89
Hacking Tools
Section: Incident Response · The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing…
FreshScore 91
Security lists for SOC/DFIR detections
Section: General
FreshScore 85
Often listed next to it
Volatility
Python based memory extraction and analysis framework.
In 8 listsDetails
Fibratus
Fibratus is a tool for exploration and tracing of the Windows kernel. It is able to capture the most of the Windows kernel activity - process/thread creation and termination, file system I/O, registry, network activity, DLL loading/unloading and much more. Fibratus has a very simple CLI which…
In 8 listsDetails
REMnux
Linux toolkit for reverse-engineering and analyzing malicious software, providing a curated collection of free community-created tools in an Ubuntu-based distribution with Docker container support. Available as a virtual appliance or installable on existing systems, with AI-powered capabilities…
In 7 listsDetails
GRR Rapid Response
Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRR provides an API client library in…
In 7 listsDetails
wazuh/wazuh
Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of monitoring file system changes, system calls and inventory changes.
In 7 listsDetails
YARA
Tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples, described as "the pattern matching swiss army knife" for file patterns and signatures.
In 5 listsDetails
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do (archived)
In 5 listsDetails
LiME
Linux kernel module for acquiring memory dumps, older than AVML but supporting additional formats and more kernel versions. With 1,700+ GitHub stars, it remains a standard tool for Linux memory acquisition in incident response engagements where kernel module loading is permitted.
In 5 listsDetails