Pe Sieve

Features

Injection Detection - Provides comprehensive scanning of process memory to identify unauthorized injected code, shellcode, and memory patches.
Malware Analysis - Scans running processes to detect injected shellcode, hooks, and malicious implants hidden in memory.
Implant Scanning - Implements scanning of running processes to report malicious implants via structured summary or JSON formats.
Process Memory Scanners - Detects injected code, shellcode, and hooks within running Windows processes by analyzing memory.
Callstack Anomaly Detection - Provides an engine to detect malicious activity by identifying anomalies and redirections within a process callstack.
In-Memory Implant Detectors - Locates and dumps malicious implants and memory patches from a target process.
Evasion Technique Detection - Identifies advanced evasion techniques including process hollowing and reflective injection by verifying PE structures in memory.
Forensic Artifact Extraction - Extracts raw segments of injected executables and shellcode from volatile memory for offline forensic examination.
Injection Heuristics - Identifies specific markers of process hollowing and reflective loading by comparing memory regions against disk images.
Process Callstack Analysis - Analyzes process callstacks to identify anomalies and detect potential malicious activity within a running process.
Process Callstack Analyzers - Detects malicious activity by identifying anomalies and redirections within a process callstack.
Windows PE Memory Analyzers - Identifies process hollowing and reflective injection by verifying Portable Executable structures in memory.
Injected Code Dumping - Extracts malicious implants, including injected executables and shellcodes, from a running process for further analysis.
Memory-Efficient Scanning - Directly maps target process memory to scan for injected code and shellcode patterns without relying on high-level APIs.
PE Header Reconstruction - Restores original executable headers and section alignments from raw memory dumps to create valid files for static analysis.
Binary Unpacking - Recovers the unpacked version of a malware sample by extracting original code from a running process.
Implant Signature Matching - Matches known malicious byte sequences and hook patterns against running process memory to detect implants.
Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
Blue Team Tools - Scans for malicious implants in memory.
Digital Forensics - Tool for detecting and dumping malicious code in memory.
Malware Analysis - Scans processes for in-memory code modifications.

Open-source alternatives to Pe Sieve

Similar open-source projects, ranked by how many features they share with Pe Sieve.

0xd4d/de4dot
0xd4d/de4dot
7,426View on GitHub
de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un
C#
View on GitHub7,426
velocidex/velociraptor
Velocidex/velociraptor
3,769View on GitHub
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Godigital-forensicsendpoint-discoveryendpoint-protection
View on GitHub3,769
ufrisk/memprocfs
ufrisk/MemProcFS
4,202View on GitHub
MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory forensic virtual file system, mapping physical memory and kernel objects into a virtual directory structure that allows users to analyze system artifacts using standard file system tools. The project distinguishes itself by providing a virtual file system for memory forensics, enabling the browsing and querying of physical memory as read-only files and folders. It also incorporates a Yara-based memory scanner to identify malware signatures and injected code within physical memor
C
View on GitHub4,202
withsecurelabs/chainsaw
WithSecureLabs/chainsaw
3,446View on GitHub
Chainsaw is a Windows forensic analysis tool used for parsing system databases and extracting security artefacts. It functions as a forensic artefact extractor and a scanner for identifying security threats and log tampering within Windows event logs. The project distinguishes itself by implementing a Sigma rule forensic scanner that applies standardized detection logic and custom rule sets to event logs and forensic artefacts. It enables threat hunting workflows by matching event data against patterns to identify malicious activity, lateral movement, and brute force attacks. The tool's capa
Rustattackblueteamchainsaw
View on GitHub3,446

See all 30 alternatives to Pe Sieve

hasherezadepe-sieve

Features

Open-source alternatives to Pe Sieve

0xd4d/de4dot

Velocidex/velociraptor

ufrisk/MemProcFS

WithSecureLabs/chainsaw

Star history

Open-source alternatives to Pe Sieve

0xd4d/de4dot

Velocidex/velociraptor

ufrisk/MemProcFS

WithSecureLabs/chainsaw