What problem does it solve?
Malware frequently hides inside legitimate Windows processes through injection techniques like DLL injection, process hollowing, and APC injection, making it invisible to basic process listing and file-based scans. This Skill provides a structured forensic workflow to detect, classify, and analyze injected code so analysts can confirm real compromises instead of chasing false positives.
Core Features & Use Cases
- Memory Forensics Detection: Uses Volatility 3 plugins (malfind, hollowfind, vadinfo, ldrmodules) to find RWX regions, unbacked PE images, and hollowed processes in memory dumps.
- Technique Classification: Maps artifacts to specific injection methods including classic DLL injection, process hollowing, APC injection, thread hijacking, reflective loading, doppelganging, and AtomBombing.
- Sysmon Event Analysis: Parses Event IDs 1, 8, and 10 to reconstruct injection timelines and identify source processes even after they terminate.
- Payload Analysis & Detection Engineering: Dumps and disassembles injected code, scans it with YARA, maps findings to MITRE ATT&CK T1055 sub-techniques, and produces Sigma detection rules.
- Use Case: An EDR alerts on svchost.exe making unusual HTTPS connections; follow the workflow to dump memory, confirm hollowing via image-hash mismatch, extract a Cobalt Strike Beacon, and generate a Sigma rule to catch recurrence.
Quick Start
Analyze this memory dump for process injection and tell me which technique was used against svchost.exe.
