What problem does it solve?
Provides a structured, expert playbook for analyzing volatile memory images to detect malware, recover credentials, investigate suspicious processes, and reconstruct incident timelines using Volatility 2 and 3.
Core Features & Use Cases
- Acquisition Guidance: Best practices for acquiring Windows, Linux, and VM memory images safely and reliably.
- Volatility 2 vs 3 Mapping: Clear command comparisons and plugin equivalences to run the correct analysis across Volatility versions.
- Process and Injection Analysis: Techniques to discover hidden processes (DKOM), reflective DLLs, RWX shellcode regions, and dumped injected sections.
- Network, File, and Registry Correlation: Correlate netscan output with processes, extract files from memory, and inspect registry hives for persistence and user activity.
- Credential Recovery & Timeline Generation: Steps for SAM/LSA extraction, cached credentials, and producing a mactime-style timeline for incident reconstruction.
- Linux Rootkit and Forensics: Linux-specific checks for syscall hooking, TTY/AF info anomalies, and shell history extraction for rootkit detection.
- Use Case: Rapidly triage a suspected compromise by identifying a malicious process, extracting its payload and network indicators, recovering any in-memory credentials, and producing a timeline for reporting.
Quick Start
Use the memory-forensics-volatility skill to analyze mem.raw, identify hidden processes and injected code, extract suspicious files and credentials, and produce an incident timeline.
