SolitudePy
231033428d
replace to utility function
2025-09-17 02:02:14 +03:00
SolitudePy
72f0bd1bba
UNICODE_STRING length checks to further detect spoofing
2025-09-17 02:02:14 +03:00
SolitudePy
207941759d
pebmasquerade plugin
2025-09-17 02:02:14 +03:00
ikelos and GitHub
78e05f9c8f
Merge pull request #1861 from kyrre/feature/parquet-arrow-renderer
...
Feature/parquet arrow renderer
2025-09-15 10:00:03 +01:00
ikelos and GitHub
81f2e7376a
Update test/renderers/test_parquet_renderers.py
2025-09-15 08:58:04 +01:00
ikelos and GitHub
50b3c22b7d
Merge pull request #1871 from blitztide/develop
...
Feature: vadyarascan enrichment
2025-09-15 08:54:38 +01:00
8090d72149
Update volatility3/framework/plugins/renderers/parquet_renderer.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-09-15 09:32:10 +02:00
4af48ae3b0
Update volatility3/framework/plugins/renderers/parquet_renderer.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-09-15 09:31:34 +02:00
4c7a9b517f
Update volatility3/framework/plugins/renderers/parquet_renderer.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-09-15 09:31:28 +02:00
86fe4485f0
Update volatility3/framework/plugins/renderers/parquet_renderer.py
...
Co-authored-by: ikelos <ikelos@users.noreply.github.com >
2025-09-15 09:31:20 +02:00
ikelos and GitHub
2b092bf32f
Merge pull request #1873 from j-t-1/README
...
Add newlines to README.md
2025-09-14 22:33:49 +01:00
j-t-1 and GitHub
bec2fb4c7f
Add newlines to README.md
...
Purely for readability.
2025-09-06 10:09:28 +01:00
ikelos and GitHub
9ad82876e0
Merge pull request #1781 from volatilityfoundation/1780-dlllist-loadcount-missing
...
1780 dlllist loadcount missing
2025-09-06 00:52:12 +01:00
Dave Lassalle
88c8bfe1ad
#1780 - bump versions
2025-09-05 13:19:51 -05:00
Kyrre-Wahl-Kongsgard
d21a81d8c3
fix: update type hints to support Python 3.8
2025-09-05 06:55:00 +02:00
blitztide
d6a791cb67
VadYaraScan: Increment version
2025-09-04 22:39:46 +01:00
Dave Lassalle
4012887e75
#1780 - cast LoadCount
2025-09-04 14:50:30 -05:00
blitztide
47219aad67
Feature: vadyarascan enrichment
...
This add contextual data to each hit with vadyarascan, saves running pslist after processing.
Original didn't have imagename or PPID
2025-08-29 03:06:23 +01:00
Kyrre-Wahl-Kongsgard
3c830e6e67
black & ruff
2025-08-06 15:43:46 +02:00
Kyrre-Wahl-Kongsgard
eb7daa95a0
flatten tree output
2025-08-06 15:38:09 +02:00
Kyrre-Wahl-Kongsgard
533b305afb
Added tests for the Parquet and Arrow renderers
2025-08-02 18:07:05 +02:00
Kyrre-Wahl-Kongsgard
11b312383c
fix: update data type mappings for format_hints.Bin and format_hints.Hex to pa.uint64
2025-07-22 10:09:55 +02:00
Kyrre-Wahl-Kongsgard
6437148dc8
remove old parquet renderer
2025-07-21 23:47:24 +02:00
Kyrre-Wahl-Kongsgard
e7c1126b05
moved the arrow/parquet renderers to a subdir for renderers
2025-07-21 23:46:14 +02:00
Kyrre-Wahl-Kongsgard
72422d0db9
fix bug: hadn't properly renamed the write_data method name
2025-07-21 13:38:54 +02:00
Kyrre-Wahl-Kongsgard
0f32bec263
restore orginal text_renderer
2025-07-14 14:20:37 +02:00
Kyrre-Wahl-Kongsgard
066076b4d8
black formatting
2025-07-14 14:10:31 +02:00
Kyrre-Wahl-Kongsgard
8479fa1c13
moved renderer parsing to after the plugins are imported
2025-07-14 14:07:44 +02:00
Kyrre-Wahl-Kongsgard
d3a6b030b7
moved arrow/parquet parsers to it's own file and reverted changes
2025-07-14 13:38:35 +02:00
Mike Auty
1ebb82a0c0
Try to fix documentation builds
2025-07-12 11:09:47 +01:00
ikelos and GitHub
1eb87178b8
Merge pull request #1854 from cpuu/develop
...
Update Linux tutorial: remove outdated info and add plugin examples
2025-07-07 19:49:20 +01:00
ikelos and GitHub
29e210bd33
Merge pull request #1837 from SolitudePy/svcdiff_malware
...
Malware categorization: windows.svcdiff
2025-07-07 19:12:40 +01:00
ikelos and GitHub
385192acd0
Merge pull request #1863 from volatilityfoundation/malfind_warning
...
Change warning to debug to not break plugin output and to conform to …
2025-07-01 00:59:18 +01:00
atcuno
97006bc61c
Change warning to debug to not break plugin output and to conform to coding standards
2025-06-30 17:27:58 -05:00
ikelos and GitHub
997f2a4f4c
Merge pull request #1856 from SolitudePy/sockstat_remove_unix
...
Plugins: remove unused unix argument in linux.sockstat
2025-06-29 16:24:05 +01:00
ikelos and GitHub
a2ebe6006e
Merge pull request #1852 from SolitudePy/syscalls_malware_plugin
...
Malware categorization: categorize EDR evading plugins with in/direct_syscall
2025-06-29 16:20:06 +01:00
ikelos and GitHub
9440075e52
Merge pull request #1851 from SolitudePy/ldr_modules_malware
...
Plugins: categorize ldrmodules as a malware plugin
2025-06-29 16:18:01 +01:00
Kyrre-Wahl-Kongsgard
78d56534c0
fix: handle layerdata to pyarrow conversion
2025-06-28 12:16:36 +02:00
Kyrre-Wahl-Kongsgard
0389596987
Fix: Avoid import-time errors if pyarrow is missing
...
- Use string type annotations for pa.* types in Arrow/Parquet renderers.
- Ensure pyarrow dependency is checked only in __init__.
2025-06-28 11:46:13 +02:00
kyrre
1c7856212f
linting
2025-06-27 17:01:08 +02:00
kyrre
a0b00766f8
formatting with ruff
2025-06-27 16:58:35 +02:00
kyrre
50767ffb8d
add arrow and parquet renderers
2025-06-27 16:33:28 +02:00
SolitudePy
65b99bc546
Plugins: remove unused unix argument in linux.sockstat
2025-06-23 12:41:17 +03:00
Jaeyou PARK and GitHub
3892237955
Update getting-started-linux-tutorial.rst : Rearrange linux.pstree plugin description
...
Moved plugin output example above the feature explanation for better flow and clarity.
Simplified the description while retaining key points about process hierarchy and anomaly detection.
2025-06-23 15:37:35 +09:00
Jaeyou PARK and GitHub
0f33734f3b
Update getting-started-linux-tutorial.rst : Add reference to Abyss-W4tcher/volatility3-symbols
...
Recommend users first check this repository for pre-generated symbol tables by kernel version for popular Linux distributions before creating their own.
2025-06-23 15:20:42 +09:00
Jaeyou PARK and GitHub
d9a6ff803b
Update getting-started-linux-tutorial.rst
...
Update memory acquisition section: remove deprecated LiME reference
LiME has been removed from the documentation due to its unmaintained status. The section now highlights AVML as an actively maintained tool, and includes a general note encouraging users to verify tool compatibility.
2025-06-23 14:53:12 +09:00
ikelos and GitHub
308a4668b7
Merge pull request #1829 from SolitudePy/regexscan
...
Regexscan fixes
2025-06-22 23:10:38 +01:00
cpuu
9df5300483
Edit link
...
link
2025-06-18 16:32:14 +09:00
cpuu
17a7fff926
Change link
...
Change link
2025-06-18 16:30:28 +09:00
cpuu
5ce5fe67dc
linux-tutorial: finalize with plugin discovery and contribution guide
...
- Added concluding section to guide users toward further plugin exploration
- Provided command to list all supported Linux plugins in Volatility 3
- Encouraged community contribution by highlighting the open-source nature of the project
- Linked to the official Volatility 3 GitHub repository for contributor reference
2025-06-18 16:24:22 +09:00
SolitudePy