Skip to content

Latest commit

 

History

History
51 lines (34 loc) · 1.43 KB

README.md

File metadata and controls

51 lines (34 loc) · 1.43 KB
Raw

Volatility plugins created by the author

The plugins published here can be used with Volatility v2.4.

BASELINE plugin suite

PROCESSBL A plugin that compares the running processes in 2 memory images - can be used to detect newly started processes - can be used to detect newly loaded DLLs

SERVICESBL A plugin that compares the services in 2 memory images - can be used to detect modification of service configuration - can be used to detect newly installed services

DRIVERBL A plugin that compares the kernel drivers in 2 memory images - can be used to detect newly installed / loaded drivers

MALPROCFIND

A plugin that searches for malicious processes based predefined rules.

Output types: text

INDX

A plugin that carves for and parses INDX ($I30) entries

Output types: text, body

USNJRNL

A plugin that carves for and parses USNJRNL ($J) entries

Output types: text, body

LOGFILE

A plugin that carves for and parses $Logfile entries. It will process the following entry types:

  • UPDATE FILENAME ALLOCATION (Partial FILENAME Attributes)
  • ADD INDEX ENTRY ALLOCATION (INDX Records)
  • DELETE INDEX ENTRY ALLOCATION (INDX Records)
  • INITIALIZE FILE RECORD SEGMENT (MFT FILE0 Records)
  • DEALLOCATE FILE RECORD SEGMENT (MFT FILE0 Records)

Output types: text, body