skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

process-injection-hunt

Detect code injection techniques in Windows memory dumps via Volatility plugins.

11|1|Updated May 4, 2026
Search Tags:#volatility#incident-response#mitre-attack#red-teaming#memory-forensics#c2-detection#process-injection
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill process-injection-hunt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: process-injection-hunt
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/memory-forensics/skills/process-injection-hunt
Command: npx skills add https://github.com/dreadnode/capabilities --skill process-injection-hunt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of detecting stealthy code injection in running system processes, a common attacker technique that evades standard endpoint detection tools and requires deep memory analysis to identify.

Core Features & Use Cases

  • Multi-technique injection detection: Covers classic RWX injection, reflective DLL loads, process hollowing, APC injection, thread hijacking, and manual mapping, aligned with MITRE ATT&CK T1055 process injection sub-techniques.
  • Structured forensic workflow: Provides a step-by-step procedure using Volatility plugins to baseline with malfind, perform DLL list gap analysis, check for process hollowing, inspect thread activity, and analyze handles and named pipes.
  • C2 framework pivoting: Includes quick checks for common command-and-control tools like Cobalt Strike, Brute Ratel, and Sliver, plus YARA rule integration to sweep for related artifacts across memory dumps and other hosts.
  • False positive disambiguation: Explicit guidance to avoid misidentifying legitimate RWX regions from .NET JIT compilation, browser/Office JIT activity, and packed legitimate software.

Quick Start

Use the process-injection-hunt skill to analyze the memory image of the suspicious process flagged during triage and confirm whether it is hosting injected foreign code.

Frequently Asked Questions about process-injection-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect process hollowing and reflective DLL injection in a memory dump?▼

To detect process hollowing and reflective DLL injection, you can run a structured Volatility workflow that baselines suspicious processes with malfind, performs DLL list gap analysis, and inspects thread activity to uncover foreign code regions.

What is the best way to hunt for MITRE ATT&CK T1055 process injection artifacts during incident response?▼

The best way to hunt for MITRE ATT&CK T1055 artifacts is to analyze Windows memory dumps for classic RWX injection, APC injection, and thread hijacking, while applying YARA rules to sweep for related command-and-control framework indicators.

How can I identify Cobalt Strike or Brute Ratel C2 frameworks in memory forensics?▼

Identify Cobalt Strike or Brute Ratel C2 frameworks in memory forensics by leveraging quick checks for named pipes and applying YARA rules across the memory dump to pivot and confirm related malicious artifacts.

Why does malfind flag legitimate RWX memory regions in Windows processes?▼

Malfind flags legitimate RWX memory regions because of false positives from .NET JIT compilation, browser JIT activity, and packed legitimate software, which require explicit disambiguation during process injection analysis.

Can I use Volatility to validate red teaming process injection techniques?▼

Yes, you can use Volatility to validate red teaming process injection techniques by analyzing the memory image of suspicious processes to confirm whether they are hosting injected foreign code and testing specific TTPs.

What steps are needed to analyze thread hijacking and APC injection in system memory?▼

To analyze thread hijacking and APC injection in system memory, execute a step-by-step procedure that inspects thread activity, checks for process hollowing, and analyzes handles and named pipes using Volatility plugins.

Related Skills

Explore More Data & Analytics Skills→
DorianGalloDorianGallo
5

memory-forensics-volatility

Analyze Volatility 2/3 memory dumps for malware and incident response evidence.

Community
Advanced
dreadnodedreadnode
11

yara-memory-hunting

Run YARA rules against full memory dumps or individual processes via Volatility.

Official
Intermediate
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
FuzzdkkFuzzdkk
3

memory-forensics

Analyze Windows and Linux RAM dumps with Volatility 3 to identify memory-resident artifacts.

Community
Advanced