<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-memory-forensics-triage
description: >-
  Performs rapid memory forensics triage using Volatility 3, AVML, and WinPmem
  to identify malicious processes, injected code, rootkits, and credential
  harvesting artifacts from volatile memory acquisitions.
domain: cybersecurity
subdomain: incident-response
tags:
  - memory-forensics
  - volatility
  - process-injection
  - rootkit-detection
  - credential-extraction
  - volatile-evidence
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003"]
---

# Performing Memory Forensics Triage

## Overview

Memory forensics triage extracts actionable intelligence from volatile memory
captures before disk-based evidence is available. This skill covers rapid memory
acquisition with WinPmem, LiME, and AVML, followed by systematic analysis using
Volatility 3 plugins to identify rogue processes, injected code, network
connections from malware, loaded kernel modules, and credential material resident
in memory.

Memory is the most volatile evidence source (RFC 3227). Triage must happen before
reboot, shutdown, or remediation actions destroy artifacts. A skilled analyst can
identify process injection, C2 beacons, and credential theft within 30 minutes
of acquisition.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Volatility 3 | Memory analysis framework | `pip install volatility3` |
| WinPmem | Windows memory acquisition | GitHub release binary |
| AVML | Linux memory acquisition | `cargo install avml` or GitHub release |
| LiME | Linux kernel memory module | `git clone https://github.com/504ensicsLabs/LiME` |
| YARA | Pattern matching in memory | `pip install yara-python` |
| strings | Extract readable strings | Pre-installed on Linux |

## Key Concepts

### Memory Acquisition Methods

| Platform | Tool | Command |
|----------|------|---------|
| Windows | WinPmem | `winpmem_mini_x64.exe mem.raw` |
| Linux | AVML | `avml /evidence/mem.lime` |
| Linux | LiME | `insmod lime.ko "path=/evidence/mem.lime format=lime"` |
| macOS | osxpmem | `osxpmem -o /evidence/mem.aff4` |

### Critical Volatility 3 Plugins

| Plugin | Detects |
|--------|---------|
| `windows.pslist` | Running processes (EPROCESS linked list) |
| `windows.psscan` | Hidden/unlinked processes (pool tag scan) |
| `windows.malfind` | Injected code (RWX memory regions) |
| `windows.netscan` | Network connections and listening ports |
| `windows.dlllist` | Loaded DLLs per process |
| `windows.handles` | Open handles (files, registry, mutexes) |
| `windows.hashdump` | Cached credential hashes (SAM) |
| `windows.lsadump` | LSA secrets from memory |
| `windows.cmdline` | Process command-line arguments |
| `windows.svcscan` | Windows service entries |
| `linux.pslist` | Linux process listing |
| `linux.bash` | Bash history from memory |

### Process Injection Indicators

- Memory regions with PAGE_EXECUTE_READWRITE protection and no mapped file
- Process hollowing: legitimate process name with suspicious parent or image path
- Discrepancy between `pslist` (linked) and `psscan` (unlinked) results
- DLL loaded from TEMP, AppData, or user-writable paths

## Workflow

### Step 1 — Acquire Memory Image

```bash
# Windows — acquire with WinPmem
winpmem_mini_x64.exe C:\evidence\mem.raw

# Linux — acquire with AVML (userspace, no kernel module needed)
avml /evidence/mem.lime

# Verify acquisition integrity
sha256sum /evidence/mem.lime > /evidence/mem.lime.sha256
ls -lh /evidence/mem.lime
```

### Step 2 — Identify Suspicious Processes

```bash
# List running processes — compare pslist vs psscan for hidden processes
vol.py -f mem.raw windows.pslist --pid 0 | tee /evidence/pslist.txt
vol.py -f mem.raw windows.psscan | tee /evidence/psscan.txt

# Diff to find hidden/unlinked processes
diff <(awk '{print $1}' /evidence/pslist.txt | sort) \
     <(awk '{print $1}' /evidence/psscan.txt | sort)

# Inspect command-line arguments for anomalies
vol.py -f mem.raw windows.cmdline | grep -i "powershell\|cmd\|wscript\|mshta\|rundll32"
```

### Step 3 — Detect Process Injection

```bash
# Scan for injected code (RWX pages without mapped files)
vol.py -f mem.raw windows.malfind | tee /evidence/malfind.txt

# Dump suspicious memory regions for analysis
vol.py -f mem.raw windows.malfind --dump --pid $SUSPICIOUS_PID \
  -o /evidence/dumps/

# Scan dumped regions with YARA
yara -r /rules/malware_signatures.yar /evidence/dumps/
```

### Step 4 — Extract Network Artifacts

```bash
# Enumerate active and closed connections
vol.py -f mem.raw windows.netscan | tee /evidence/netscan.txt

# Filter for external connections (non-RFC1918)
grep -vE '(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' \
  /evidence/netscan.txt | sort -t: -k2 -n
```

### Step 5 — Extract Credentials

```bash
# Dump cached password hashes
vol.py -f mem.raw windows.hashdump | tee /evidence/hashdump.txt

# Extract LSA secrets
vol.py -f mem.raw windows.lsadump | tee /evidence/lsadump.txt

# Linux — extract bash history from memory
vol.py -f mem.lime linux.bash | tee /evidence/bash_history.txt
```

### Step 6 — Timeline and Correlate

```bash
# Build process timeline
vol.py -f mem.raw windows.pslist | \
  awk '{print $NF, $1, $3, $4}' | sort > /evidence/process_timeline.txt

# Cross-reference suspicious PIDs across all plugins
SUSPECT_PID=1234
for plugin in windows.dlllist windows.handles windows.cmdline windows.netscan; do
  echo "=== $plugin ===" >> /evidence/pid_${SUSPECT_PID}_report.txt
  vol.py -f mem.raw "$plugin" --pid "$SUSPECT_PID" >> /evidence/pid_${SUSPECT_PID}_report.txt
done
```

## Detection

```yaml
title: Memory Forensics Triage Detection
id: bcc9edef-aca1-4f45-b169-5df05dd47c86
status: experimental
description: Detects suspicious activity related to performing memory forensics triage techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*memory*"
  condition: selection
level: high
tags:
  - attack.t1003
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Memory image acquired before system reboot or remediation
- [ ] SHA-256 hash recorded for chain of custody
- [ ] `pslist` vs `psscan` diffed to identify hidden processes
- [ ] `malfind` results reviewed for injected code regions
- [ ] Network connections extracted and external IPs flagged
- [ ] Credential material extracted and scope of compromise assessed
- [ ] Suspicious memory regions dumped and scanned with YARA
- [ ] All findings correlated by PID across Volatility plugins

## References

- Volatility 3 Documentation: https://volatility3.readthedocs.io
- SANS Memory Forensics Cheat Sheet (FOR508)
- RFC 3227: Guidelines for Evidence Collection and Archiving
- The Art of Memory Forensics — Ligh, Case, Levy, Walters
- MITRE ATT&CK T1055 (Process Injection)
- MITRE ATT&CK T1003 (OS Credential Dumping)
