awesome-volatility

Plugin to detect ACPI rootkits

whitelist code found by apihooks based on an ssdeep hash

Plugin for Detecting APT17 malware

Finding persistence points (also called "Auto-Start Extensibility Points", or ASEPs) is a recurring task of any investigation potentially involving malware.

Run several volatility plugins at the same time

Plugin that retrieves the Full Volume Encryption Key (FVEK) in memory

Scans for MFT entries looking for alternate data streams that may be cached in memory

The plugin is scanning, extracting and parsing Windows AnyDesk trace files.

Scans for API hashes used as arguments to functions in memory regions that wouldn’t typically have executable code. It then attempts to resolve the hashes leveraging a publicly available hash database

This plugin helps identifying pointers to APIs (functions defined in loaded DLLs). It does that by iterating over all loaded DLLs, enumerating their exports and searching for any pointers to the exported functions.

Finding persistence points (also called "Auto-Start Extensibility Points", or ASEPs) is a recurring task of any investigation potentially involving malware. (Port of tomchop's autoruns plugin for Volatility 3)

Helps visualize the state of the BPF subsystem as a graph