gleeda
Core Developer for the @volatilityfoundation | Director of R&D for @huntresslabs | Overall DFIR enthusiast.
@volatilityfoundation @huntresslabs
Pinned Repositories
BoomBox
Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant
capa
The FLARE team's open-source tool to identify capabilities in executable files.
gleeda.github.com
malboxes
Builds malware analysis Windows VMs so that you don't have to.
memtriage
Allows you to quickly query a Windows machine for RAM artifacts
misc-scripts
misc scripts
openpyxl
clone of openpyxl
Vol-TODO
Volatility-Plugins
Plugins for the most recent branch of Volatility
volatility-sqlite
volatility sqlite
gleeda's Repositories
gleeda/memtriage
Allows you to quickly query a Windows machine for RAM artifacts
gleeda/misc-scripts
misc scripts
gleeda/gleeda.github.com
gleeda/openpyxl
clone of openpyxl
gleeda/Vol-TODO
gleeda/BoomBox
Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant
gleeda/capa
The FLARE team's open-source tool to identify capabilities in executable files.
gleeda/malboxes
Builds malware analysis Windows VMs so that you don't have to.
gleeda/epa-climate-change
gleeda/flare-floss
FireEye Labs Obfuscated String Solver - Automatically extract obfuscated strings from malware.
gleeda/gargoyle
A memory scanning evasion technique
gleeda/Mirai-Source-Code
Leaked Mirai Source Code for Research/IoC Development Purposes
gleeda/RDP-Replay
Replay RDP traffic from PCAP
gleeda/subTee-gits-backups
subTee gists code backups
gleeda/virtual-reality
Stealthy backdoor for Windows operating systems
gleeda/volatility
An advanced memory forensics framework
gleeda/block-parser
Parser for Windows PowerShell script block logs
gleeda/capa-rules
Standard collection of rules for capa: the tool for enumerating the capabilities of programs
gleeda/climate
gleeda/Content-IRPowerForensics
PowerForensics provides an all in one platform for live disk forensic analysis
gleeda/distorm
Powerful Disassembler Library For x86/AMD64
gleeda/flare-wmi
gleeda/LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
gleeda/osx-vm-templates
macOS templates for Packer and VeeWee.
gleeda/presentations
gleeda/python-pachyderm
Python client for Pachyderm
gleeda/ssh-chat
Chat over SSH.
gleeda/syncthing
Open Source Continuous File Synchronization
gleeda/unicorn
Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
gleeda/WSL2-Linux-Kernel
The source for the Linux kernel used in Windows Subsystem for Linux 2 (WSL2)