Memory Forensics

概要

mem-forensics-mcp is a sophisticated, multi-tier memory forensics server designed to streamline the analysis of memory images. It intelligently routes forensic tasks across a high-speed Rust engine for common operations, Python-based analyzers for intelligent anomaly detection and correlation, and the comprehensive Volatility3 for broader coverage of specialized plugins. This architecture ensures rapid triage, in-depth investigation, and actionable insights by transforming raw data into correlated findings and threat intelligence.

主な機能

• 0 GitHub stars
• Multi-tier engine for optimized performance and comprehensive coverage
• Rapid triage with high-speed Rust-based memory analysis for core plugins
• Intelligent anomaly and C2 detection via Python-based analyzers
• Full integration with Volatility3 for specialized and in-depth forensic needs
• Integrated threat intelligence lookups (e.g., VirusTotal for hashes, IPs, and domains)

ユースケース

• Automated full memory image triage for rapid incident response and threat assessment
• Deep-dive analysis of memory artifacts like injected code, process anomalies, and network connections
• Extraction of critical forensic data such as credentials, command history, and cached files from memory dumps