DRAKVUF

No entries match these filters. Clear filters

1. docs update Oct 31, 2026 · issue 126
   • New supported platform Windows 10 and Windows 11 64-bit support
2. 1.0 Dec 29, 2022 · release notes

   DRAKVUF 1.0 adds Meson build support and seven new community plugins

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.0 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 1.0

   • Adds SprayMon plugin for monitoring spray operations.
   • Adds CallbackMon plugin for monitoring callback registrations.
   • Adds HideVM plugin for detecting virtual machine hiding techniques.
   • Adds PTraceMon plugin for monitoring ptrace syscalls.
   • Adds EBPFMon plugin for monitoring eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs and maps.

   +2 more show less

   • Adds UnixSocketMon plugin for monitoring Unix domain sockets.
   • Adds ETWMon plugin for monitoring Event Tracing for Windows.

   7 details in Everything

3. 0.8 Dec 21, 2021 · release notes

   DRAKVUF 0.8 introduces nine new plugins including codemon, hidsim, and filetracer for Linux.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.8 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.8

   └──▷ TRY IT
   Use the new Linux filetracer to audit file access events in a guest OS.
   copy

   $ drakvuf --name <guest_name> --plugin 'filetracer:linux'

   Monitor for exploitation techniques using the new exploitmon plugin.
   copy

   $ drakvuf --name <guest_name> --plugin 'exploitmon'

   Capture process memory dumps in real-time using the procdump2 plugin.
   copy

   $ drakvuf --name <guest_name> --plugin 'procdump2'

   • Adds codemon plugin for capturing memory dumps from running processes.
   • Adds hidsim plugin for simulating host intrusion detection events.
   • Adds filetracer plugin support for Linux guests.
   • Adds procdump2 plugin for process memory dumping with improved capabilities.
   • Adds tlsmon plugin for monitoring TLS traffic within VMs.

   +4 more show less

   • Adds rpcmon plugin for monitoring Remote Procedure Call activity.
   • Adds rootkitmon plugin for detecting rootkits via hook monitoring.
   • Adds exploitmon plugin for identifying exploit patterns in real-time.
   • Adds ipt plugin for IP Trace Table monitoring.

   9 details in Everything

4. 0.7 Jul 25, 2020 · release notes

   DRAKVUF 0.7 introduces procdump, apimon, and REPL plugins alongside libusermode library for usermode monitoring.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.7 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.7

   • Adds procdump plugin to capture process memory dumps within the hypervisor.
   • Adds apimon plugin to monitor application programming interface calls.
   • Adds REPL interactive console for live command execution during analysis.
   • Introduces libusermode helper library to enable monitoring of usermode code execution.

   4 details in Everything

5. 0.6 Oct 5, 2019 · release notes

   DRAKVUF 0.6 adds Linux injector support and ten new monitoring plugins

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.6 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.6

   • Adds Linux OS support to the Injector module
   • Introduces Regmon plugin for registry monitoring
   • Introduces Procmon plugin for process monitoring
   • Introduces BSODmon plugin for blue-screen detection
   • Introduces EnvMon plugin for environment variable monitoring

   +7 more show less

   • Introduces CrashMon plugin for crash detection
   • Introduces ClipboardMon plugin for clipboard event capture
   • Introduces WindowMon plugin for window event monitoring
   • Introduces LibraryMon plugin for library load events
   • Introduces DKOMmon plugin for DKOM detection
   • Introduces WMIMon plugin for WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. event monitoring
   • Introduces MEMDump plugin for memory dumping

   12 details in Everything

6. 0.5 Jun 30, 2017 · release notes

   DRAKVUF 0.5 adds socketmon plugin for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. monitoring and improves filetracer via syscalls.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.5 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.5

   • Adds socketmon plugin to monitor TCP and UDP connections for Windows guests
   • Updates filetracer to use syscalls instead of ExAllocatePoolWithTag for better reliability
   • syscall plugin now prints detailed arguments for Windows guests

   3 details in Everything

7. 0.3 Aug 31, 2016 · release notes

   DRAKVUF 0.3 adds a new plugin to monitor malware modifying the SSDT

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.3 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.3

8. 0.2 Mar 31, 2016 · release notes

   DRAKVUF 0.2 adds multi-vCPU guest support and a plugin system for generic monitoring.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.2 https://github.com/tklengyel/drakvuf.git
   # already have the repo? check out this version:
   $ git checkout 0.2

   • Adds support for multi-vCPU guests on Xen 4.6
   • Adds a plugin system to interact with the generic monitoring capability

   2 details in Everything