Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.

SKILL: Memory Forensics — Expert Analysis Playbook AI LOAD INSTRUCTION : Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux specific memory analysis. 0. RELATED ROUTING Before going deep, consider loading: [traffic analysis pcap](../traffic analysis pcap/SKILL.md) for correlating network artifacts with memory findings [steganography techniques](../steganography techniques/SKILL.md) if hidden data suspected in extracted files [windows privilege escalation](../windows privilege escalation/SKILL.md) for understanding post exploitation artifacts in memory Quick Reference Also load [VOLATILITY CHEATSHEET.md](./VOLATILITY CHEATSHEET.md) when you need: Vol2 vs Vol3 command comparison table Common plugin sequences for specific investigation types 1. MEMORY ACQUISITION Linux Windows Virtual Machines 2. VOLATILITY 2 vs 3 Concept Volatility 2 Volatility 3 Profile system profile=Win10x64 19041 Auto detected (symbol tables) Image info imageinfo windows.info / linux.info Process list pslist windows.pslist Network netscan / connections windows.netscan / windows.netstat DLLs dlllist windows.dlllist Injection malfind windows.malfind Hashes hashdump windows.hashdump Files filescan windows.filescan Registry hivelist / printkey windows.registry.hivelist / windows.registry.printkey Install pip2 install volatility pip3 install volatility3 3. ANALYSIS METHODOLOGY Step 1: Identify OS Step 2: Process Listing — Hidden Process Detection Red flags : Process in psscan but not pslist = DKOM (Direct Kernel Object Manipulation) hiding. Step 3: Network Connections Step 4: DLL / Module Analysis Red flags : DLL in dlllist but False in all three ldrmodules columns = reflective DLL injection. Step 5: Code Injection Detection (Malfind) What malfind detects : Memory regions with PAGE EXECUTE READWRITE that don't map to a file on disk — classic shellcode/injection indicator. Step 6: Credential Extraction Step 7: File Extraction Step 8: Registry Analysis Step 9: Command History Step 10: Timeline Generation 4. LINUX MEMORY ANALYSIS Building Linux Profiles (Vol2) 5. MALWARE INDICATORS IN MEMORY Indicator Detection Method What It Means Process in psscan but not pslist Compare pslist vs psscan DKOM — process hiding Unexpected parent child pstree analysis e.g., svchost spawned by cmd.exe MZ header in non image memory malfind Reflective DLL / PE injection RWX memory without backing file malfind Shellcode injection DLL unlinked from all PEB lists ldrmodules (all False) Stealth DLL loading svchost.exe not child of services.exe pstree Fake svchost (malware) Unusual network connections netscan + PID correlation C2 communication Hooking in SSDT/IDT ssdt / idt plugins Rootkit Modified kernel objects linux check syscall Linux rootkit Normal Parent Child Relationships (Windows) 6. DECISION TREE

memory-forensics-volatility