cpuu
e8f36325ec
linux-tutorial: add boottime plugin example
...
- Added new section for linux.boottime plugin
- Demonstrated how to extract system boot time from memory
- Explained its relevance for timeline analysis and incident response
2025-06-18 15:59:27 +09:00
cpuu
25e15f12fa
linux-tutorial: update banners section
...
- Removed outdated instructions referencing the ISF server
- Updated guidance to reflect current method of manually generating ISF files
- Clarified placement of ISF files under volatility3/symbols for automatic detection
2025-06-18 15:52:08 +09:00
cpuu
46609d418a
linux-tutorial: revise plugin listing section
...
- Replaced outdated and partial plugin list with a concise summary
- Mentioned total number of supported Linux plugins (~40+)
- Highlighted representative plugins such as pslist, bash, lsmod, etc.
- Provided updated command to enumerate all available Linux plugins
2025-06-18 15:42:35 +09:00
cpuu
253b274cfb
linux-tutorial: update symbol table section
...
- Removed outdated reference to the Linux ISF Server (service no longer available)
- Updated symbol table instructions to reflect current volatility3 behavior
(symbol files now auto-detected from volatility3/symbols directory)
2025-06-18 15:35:51 +09:00
ikelos and GitHub
f5feee842d
Merge pull request #1841 from SolitudePy/check_creds_malware
...
Malware categorization: linux.check_creds
2025-06-12 08:05:01 +01:00
ikelos and GitHub
470c53c5f7
Merge branch 'develop' into check_creds_malware
2025-06-11 22:21:59 +01:00
ikelos and GitHub
63019c0988
Merge pull request #1833 from SolitudePy/psxview_malware
...
Malware categorization: windows.psxview
2025-06-11 22:18:32 +01:00
ikelos and GitHub
76db04c494
Merge pull request #1807 from volatilityfoundation/bugfix/windows_thrdscan_tuple_unpacking
...
Windows Thrdscan: Fix broken tuple unpacking
2025-06-11 14:06:43 +01:00
ikelos and GitHub
58f441186c
Merge pull request #1850 from SolitudePy/malware_plugins_category
...
Malware categorization: linux.tty_check, linux.netfilter, linux.modxview
2025-06-10 21:20:12 +01:00
ikelos and GitHub
43ed10a4f8
Merge pull request #1846 from SolitudePy/linux_malware_plugins
...
Malware categorization: linux.malfind & linux.keyboard_notifiers
2025-06-10 21:07:42 +01:00
ikelos and GitHub
58e41d754a
Merge pull request #1845 from SolitudePy/categorize_linux_malware
...
Malware categorization: linux.check_afinfo & linux.hidden_modules
2025-06-10 21:05:41 +01:00
ikelos and GitHub
9596893f1b
Merge pull request #1844 from SolitudePy/check_syscall_malware
...
Malware categorization: linux.check_syscall
2025-06-10 21:02:34 +01:00
ikelos and GitHub
e06910c763
Merge pull request #1843 from SolitudePy/check_modules_malware
...
Malware categorization: linux.check_modules
2025-06-10 21:00:02 +01:00
ikelos and GitHub
c62d77e4e2
Merge pull request #1842 from SolitudePy/check_idt_malware
...
Malware categorization: linux.check_idt
2025-06-10 20:58:04 +01:00
ikelos and GitHub
f2f83f5ce1
Merge pull request #1838 from SolitudePy/unhooked_syscalls_malware
...
Malware categorization: windows.unhooked_system_calls
2025-06-10 20:54:33 +01:00
SolitudePy
8040c049e0
Tests: change class name for tty_check
2025-06-10 20:30:05 +03:00
SolitudePy
e3877f68ec
Plugins: categorize linux.tty_check as a malware plugin
2025-06-10 19:37:57 +03:00
SolitudePy
77801e4cb0
Plugins: categorize linux.netfilter as a malware plugin
2025-06-10 19:22:12 +03:00
SolitudePy
6c35bc3fa0
Plugins: categorize linux.modxview as a malware plugin
2025-06-10 19:12:09 +03:00
SolitudePy
a06d59bc52
Plugins: categorize linux.malfind as a malware plugin
2025-06-07 22:58:46 +03:00
SolitudePy
faf7d781be
Plugins: categorize linux.keyboard_notifiers as a malware plugin
2025-06-07 22:55:29 +03:00
SolitudePy
f9941b5b6e
black
2025-06-07 22:00:03 +03:00
SolitudePy
c71fd30c8a
shortcut class name
2025-06-07 21:58:43 +03:00
SolitudePy
21d66839fe
use class name with module name?
2025-06-07 21:56:36 +03:00
SolitudePy
35c4e9f50b
Plugins: change class name to original
2025-06-07 21:52:22 +03:00
ikelos and GitHub
ebd6c8719a
Merge pull request #1840 from SolitudePy/drivermodule_malware
...
Malware categorization: windows.drivermodule
2025-06-07 18:09:57 +01:00
SolitudePy
5144f26a8e
CI
2025-06-07 19:58:12 +03:00
SolitudePy
1d2b78976a
Plugins: categorize linux.hidden_modules as a malware plugin
2025-06-07 19:54:44 +03:00
SolitudePy
962665b412
Plugins: categorize linux.check_afinfo as a malware plugin + test fix
2025-06-07 19:44:50 +03:00
SolitudePy
70514396b3
linux.malware.check_syscall - fix test
2025-06-07 19:35:26 +03:00
SolitudePy
5b538d1686
Plugins: categorize linux.check_syscall as a malware plugin
2025-06-07 19:35:19 +03:00
SolitudePy
4b279f9633
linux.malware.check_modules - fix test
2025-06-07 19:30:04 +03:00
SolitudePy
832c997e20
Plugins: categorize linux.check_modules as a malware plugin
2025-06-07 19:29:55 +03:00
SolitudePy
4bc1bb818d
linux.malware.check_idt - fix doc & test deps
2025-06-07 19:23:13 +03:00
SolitudePy
c36fdd69f6
Plugins: categorize linux.check_idt as a malware plugin
2025-06-07 19:22:58 +03:00
SolitudePy
85a5eb5d41
linux.malware.check_creds - fix deps in: test, doc
2025-06-07 18:42:42 +03:00
SolitudePy
8acf97c475
Plugins: categorize linux.check_creds as a malwarep lugin
2025-06-07 18:42:13 +03:00
SolitudePy
ef07b07659
Plugins: categorize windows.drivermodule as a malware plugin
2025-06-07 18:25:53 +03:00
SolitudePy
f97bc920bb
Plugins: changed class name due to incorrect resolution
2025-06-07 18:09:26 +03:00
SolitudePy
66473ac644
categorize windows.unhooked_system_calls as a malware plugin
2025-06-07 18:00:36 +03:00
ikelos and GitHub
2fbb872c9a
Merge pull request #1834 from SolitudePy/skel_key_malware
...
Malware categorization: windows.skeleton_key_check
2025-06-07 15:12:37 +01:00
ikelos and GitHub
84c33916df
Merge pull request #1835 from SolitudePy/suspicious_threads_malware
...
Malware categorization: windows.suspicious_threads
2025-06-07 15:10:02 +01:00
ikelos and GitHub
9c84152eea
Merge pull request #1832 from SolitudePy/processghosting_malware
...
Malware categorization: windows.processghosting
2025-06-07 15:07:36 +01:00
ikelos and GitHub
2bd9a0e710
Merge pull request #1831 from SolitudePy/hollowprocesses_malware
...
Malware categorization: windows.hollowprocesses
2025-06-07 15:05:59 +01:00
ikelos and GitHub
3f9794b3dc
Merge pull request #1830 from SolitudePy/malfind_malware
...
Malware categorization: windows.malfind
2025-06-07 15:04:23 +01:00
SolitudePy
48a97166ea
categorize windows.skeleton_key_check as malware plugin
2025-06-07 16:30:49 +03:00
Mike Auty
520e2cfcdd
Core: Fix up warning message
2025-06-07 14:21:22 +01:00
Mike Auty
c85026ee91
Core: Ensure people running renamed plugins know that the plugins are deprecated
2025-06-07 14:20:37 +01:00
SolitudePy
a95ebfe3fd
categorize windows.suspicious_threads as malware plugin
2025-06-07 16:06:32 +03:00
SolitudePy
e5738c1263
categorize windows.psxview as malware plugin
2025-06-07 14:03:36 +03:00
cpuu