f-block Goto Github PK

blackhat-eu-2019

This is the Online repository for the Black Hat EU 2019 Talk: Detecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries.

blackhat-usa-2019

blackhat-usa-2020

conventionengine

ConventionEngine - A Yara Rulepack for PDB Path Hunting

dfrws-usa-2017

dfrws-usa-2019

dfrws-usa-2020

dfrws-usa-2023

Additional material for the DFRWS USA 2023 submission "Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files"

gunziper

Burp Suite extension

hashtest

Validate integrity of in memory code

hollowfind

Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect and divert the forensic analysis techniques. The plugin detects such attacks by finding discrepancy in the VAD and PEB, it also disassembles the address of entry point to detect any redirection attempts and also reports any suspicious memory regions which should help in detecting any injected code.

insinuator-snippets

A collection of code snippets used in blog posts.

process-hollowing

Fork of m0n0ph1/Process-Hollowing with some modifications

reflectivedllinjection

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

rekall

Rekall Memory Forensic Framework

rekall-plugins

rekall-profiles

Public Profile Repository for Rekall Memory Forensic.

sigma

Generic Signature Format for SIEM Systems

velociraptor-docs

Documentation site for Velociraptor

volatility-plugins

volatility3

Volatility 3.0 development

xssvalidator

This is a burp intruder extender that is designed for automation and validation of XSS vulnerabilities.

yara-rules