MalConfScan
MalConfScan is a Volatility plugin that extracts configuration data of known malware, searches for malware in memory images, and dumps configuration data. It also has a function to list strings to which malicious code refers. Supported malware families include Ursnif, Emotet, Smoke Loader, PoisonIvy, CobaltStrike, and many others. Additionally, it can dump decoded strings or DGA domains. MalConfScan also provides additional analysis by listing strings to which malicious code refers and decoding configuration data usually encoded by malware.
FEATURES
SIMILAR TOOLS
Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.
A collaborative forensic timeline analysis tool for organizing and analyzing data with rich annotations and comments.
A framework for orchestrating forensic collection, processing, and data export.
A tool for triaging crash files with various output formats and debugging engine options.
XMLStarlet offers a suite of command line utilities for manipulating and querying XML documents.
A collection of tools for extracting and analyzing information from .git repositories
Python script to parse macOS MRU plist files into human-friendly format
Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix's Security Intelligence and Response Team (SIRT) for scoping compromises across cloud instances.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.