Official account of the Volatility Memory Analysis Project and Windows Malware and Memory Forensics Training. https://t.co/A4TZ1FOjpggithub.com/volatilityfoun…Joined August 2008
I am excited to announce that I will be speaking at @bsidesnash on May 15th. Be sure to attend to see all the latest @volatility 3 plugins against the most sophisticated and devastating malware from the wild!
Memory-only malware leaves no trace on the file system & is commonly used by threat actors ranging from criminal organizations to ransomware operators to APTs. In our @volatility 3 training, students gain deep hands on experience analyzing such threats:
memoryanalysis.net/courses-malwar…
The 2025 @volatility#PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!
We will be highlighting each #Contender & the winners will be announced on Friday!
#DFIR#memoryforensics
The annual @volatility#PluginContest continues to highlight how #memoryforensics researchers are innovating + contributing to #Volatility3!
Special thanks to the core developers & previous winners who helped review this year's submissions!
The 2025 @volatility#PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!
We will be highlighting each #Contender & the winners will be announced on Friday!
#DFIR#memoryforensics
The 2025 @volatility#PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!
We will be highlighting each #Contender & the winners will be announced on Friday!
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Théo Letailleur: Journald Extractor automates extraction of Linux journal files cached in memory, along with analysis via the open-source go-journalctl tool to obtain parsed versions of these files from memory.
#DFIR#memoryforensics
The 2025 @volatility#PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins!
We will be highlighting each #Contender & the winners will be announced on Friday!
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Kyrre Wahl Kongsgård: Arrow & Parquet Renderers allows #Volatility3 plugin output to be written via the Arrow + Parquet renderers, enabling the output to be integrated into tools for modern data analysis workflows.
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Diyar Saadi Ali: This submission includes a suite of detection plugins & tools to identify suspicious processes + artifacts within the memory sample of a suspected system using a variety of heuristics & indicators.
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Kartik Iyer: APCWatch & MalAPC together provide the capability to identify & analyze APC injection attacks in Windows memory forensics, one of the most sophisticated code injection techniques employed by modern malware
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Thomas Clark: The EA App Artifacts, MetaHorizonWorlds & SteamArtifacts plugins help investigators with incidents involving popular gaming platforms by scanning memory for relevant processes and artifacts.
#DFIR#memoryforensics
.@volatility#PluginContest#Contender
Devarjya Purkayastha: PEScan provides an alternative method for analyzing PE files in a memory sample, assigning a threat score to each memory region that contains a PE file & summarizing high/critical regions.
#DFIR#memoryforensics
Kerberos plugin for @volatility allows you to list and extract tickets from memory dump. Another way to track user activity by checking services tickets !
github.com/airbus-cert/vo…
We’ve now made our @DEATHCon2025 workshop
Building Custom Memory Analysis Tools with the Modern Python Data Ecosystem publicly available.
The workshop shows how to build custom memory forensics tools on top of @volatility output using @marimo_io, @duckdb, and @IbisData.
We start with an introduction to marimo notebooks, DuckDB, and the Ibis dataframe library, then move into incident response workflows where Volatility plugin output is treated as tabular data stored in DuckDB tables and processed and presented interactively in a notebook environment.
From there, we build reusable analysis components, show how marimo’s reactive execution model enables a custom interactive environment for YARA development, demonstrate how to process string data contained in memory dumps, and finally show how to create custom interactive visualizations and widgets.
All notebooks, files, and accompanying videos are now available to everyone.
Today is the last day to submit entries to the #PluginContest! This is your chance to gain industry-wide visibility for your work, contribute to an important open-source project, and compete for cash prizes! More details below!👇
55K Followers 3K FollowingDirector of Intel at @redcanary. SANS Certified Instructor for FOR578: CTI. Senior Fellow at @CyberStatecraft. She/her. Mastodon: @[email protected]
32K Followers 575 FollowingConsultant for InfoSec Innovations | @SANSInstitute Principal Instructor | @IANS_Security Faculty | I like information security. How about you?
22K Followers 599 FollowingDigital forensics and incident response. Ex-AFOSI, Mandiant, and CrowdStrike. SANS Institute Fellow and co-author of #FOR500 and #FOR508 courses.
90K Followers 952 FollowingProgrammer, #malware analyst. Author of #PEbear, #PEsieve, #TinyTracer. Private account. All opinions expressed here are mine only (not of my employer etc)
587 Followers 2K FollowingPioneering technology to find families, build connections, and create community for children in the foster care system. https://t.co/mi3noBopu0 💙
445 Followers 193 FollowingWe an open, informal group that meets around good food and drink to discuss current trends and research in computer security.
4K Followers 5K Following#Professor, #hacker, systems programmer. Director of the @LSU #Cyber Center and ACL. @lsucyber #C #dfir 🇺🇸 #cybersecurity 🦋 → @nolaforensix.bsky.social
10K Followers 1K FollowingCTO @Volexity. Malware Analyst's Cookbook. Art of Memory Forensics. The @Volatility Project. Thoughts are those of my employer, not mine, they made me say it.
10K Followers 6K Following@Volatility Core Dev | Art of Memory Forensics co-author | Sr. Director of Adversary Tactics @HuntressLabs | #DFIR enthusiast/trainer | [email protected]