<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-memory-forensics
description: >-
  Analyzes memory dumps using Volatility 3 to extract processes, network connections,
  injected code, rootkits, and encryption keys from RAM captures.
domain: cybersecurity
subdomain: incident-response
tags:
  - memory-forensics
  - volatility
  - RAM-analysis
  - malware-analysis
  - rootkit-detection
  - process-injection
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003"]
---

# Conducting Memory Forensics

## Overview

Memory forensics reveals what a system was doing at the time of capture — running
processes, network connections, loaded DLLs, injected code, decrypted data, and
artifacts that never touch disk. Volatility 3 is the primary framework for structured
memory analysis across Windows, Linux, and macOS memory images.

Memory analysis frequently uncovers fileless malware, process injection, rootkits,
and credential material that disk forensics misses entirely.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Volatility 3 | Memory analysis framework | `pip install volatility3` |
| Volatility symbol tables | OS-specific parsing | Auto-download or manual |
| YARA | Pattern matching in memory | `pip install yara-python` |
| strings | ASCII/Unicode string extraction | Built-in |
| bulk_extractor | Carve artifacts from memory | Package manager |

## Key Concepts

### Volatility 3 Plugin Categories

#### Process Analysis
- `windows.pslist` — List processes from EPROCESS doubly-linked list
- `windows.psscan` — Scan for EPROCESS structures (finds hidden/unlinked)
- `windows.pstree` — Process tree with parent-child relationships
- `windows.cmdline` — Command line arguments per process
- `windows.dlllist` — Loaded DLLs per process

#### Network Analysis
- `windows.netscan` — Active and recently closed connections
- `windows.netstat` — Network connections from kernel structures
- `linux.sockstat` — Linux socket information

#### Code Injection Detection
- `windows.malfind` — Find injected code (PAGE_EXECUTE_READWRITE)
- `windows.hollowprocesses` — Detect process hollowing
- `windows.vadinfo` — Virtual Address Descriptor analysis

#### Rootkit Detection
- `windows.ssdt` — System Service Descriptor Table hooks
- `windows.callbacks` — Kernel callback registrations
- `windows.driverirp` — IRP hook detection
- `linux.check_syscall` — Syscall table modifications

#### Credential Extraction
- `windows.hashdump` — SAM database password hashes
- `windows.lsadump` — LSA secrets
- `windows.cachedump` — Domain cached credentials

### Process Anomaly Indicators

| Indicator | Normal | Suspicious |
|-----------|--------|------------|
| svchost.exe parent | services.exe | Any other parent |
| lsass.exe instances | Exactly 1 | Multiple instances |
| csrss.exe sessions | Session 0 and 1 | Additional sessions |
| explorer.exe parent | userinit.exe | cmd.exe, powershell.exe |
| Process path | \Windows\System32 | \Temp, \Users, \AppData |

## Workflow

### Step 1 — Identify OS and Profile

```bash
# Determine OS from memory image
vol.py -f memory.raw banners.Banners
vol.py -f memory.raw windows.info

# Verify image integrity
sha256sum memory.raw
```

### Step 2 — Process Analysis

```bash
# List processes (linked list)
vol.py -f memory.raw windows.pslist

# Scan for hidden/terminated processes
vol.py -f memory.raw windows.psscan

# Compare pslist vs psscan — differences indicate hidden processes
diff <(vol.py -f memory.raw windows.pslist 2>/dev/null | awk '{print $1}' | sort) \
     <(vol.py -f memory.raw windows.psscan 2>/dev/null | awk '{print $1}' | sort)

# Process tree
vol.py -f memory.raw windows.pstree

# Command lines
vol.py -f memory.raw windows.cmdline
```

### Step 3 — Network Analysis

```bash
# Active network connections
vol.py -f memory.raw windows.netscan

# Filter for established connections to external IPs
vol.py -f memory.raw windows.netscan | grep ESTABLISHED | grep -v "127.0.0.1\|0.0.0.0\|::1"
```

### Step 4 — Code Injection and Malware Detection

```bash
# Find injected code segments
vol.py -f memory.raw windows.malfind

# Dump suspicious process memory
vol.py -f memory.raw windows.malfind --dump --pid $PID -o /evidence/malfind/

# Scan memory with YARA rules
vol.py -f memory.raw yarascan.YaraScan --yara-file /rules/malware.yar

# Extract strings from suspicious process
vol.py -f memory.raw windows.memmap --dump --pid $PID -o /evidence/memdump/
strings -a -el /evidence/memdump/*.dmp > /evidence/strings-unicode.txt
strings -a /evidence/memdump/*.dmp > /evidence/strings-ascii.txt
```

### Step 5 — Credential Extraction

```bash
# SAM hashes
vol.py -f memory.raw windows.hashdump

# LSA secrets
vol.py -f memory.raw windows.lsadump

# Cached domain credentials
vol.py -f memory.raw windows.cachedump
```

### Step 6 — Rootkit Detection

```bash
# Check SSDT hooks
vol.py -f memory.raw windows.ssdt

# Kernel callbacks
vol.py -f memory.raw windows.callbacks

# Driver IRP hooks
vol.py -f memory.raw windows.driverirp

# Linux syscall table check
vol.py -f memory.lime linux.check_syscall
```

## Detection

```yaml
title: Memory Forensics Detection
id: 88281198-9607-4540-b030-15382711f965
status: experimental
description: Detects suspicious activity related to conducting memory forensics techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*conducting*memory*"
  condition: selection
level: high
tags:
  - attack.t1003
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Memory image integrity verified (SHA-256 match)
- [ ] Process list compared (pslist vs psscan) for hidden processes
- [ ] Network connections extracted and external IPs identified
- [ ] Malfind results reviewed for injected code
- [ ] YARA scan completed with current rule set
- [ ] Credential hashes extracted and secured
- [ ] Rootkit indicators checked (SSDT, callbacks, drivers)
- [ ] All findings documented with process IDs and timestamps

## References

- Volatility 3 Documentation: https://volatility3.readthedocs.io
- The Art of Memory Forensics (Ligh, Case, Levy, Walters)
- SANS FOR508: Advanced Incident Response and Threat Hunting
- Volatility Plugin Reference: https://github.com/volatilityfoundation/volatility3
