Analyze System Memory for Security Incidents

This skill covers acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. It covers live memory acquisition per OS - Windows (WinPmem, DumpIt, Belkasoft RAM Capturer, Magnet RAM Capture), Linux (LiME kernel module, /dev/mem, /proc/kcore), and macOS (osxpmem, MacQuisition) - plus pulling memory from virtual machines (VMware .vmem, VirtualBox dumpvmcore, QEMU virsh dump, Hyper-V checkpoints). The Volatility 3 framework's installation, symbol-table setup, and essential plugins span process analysis (pslist, pstree, hidden-process psscan, memmap --dump, envars, cmdline), network analysis (netscan, netstat), DLL/module analysis (dlllist, ldrmodules, modules, moddump), injection detection (malfind, vadinfo, vadyarascan), registry analysis (hivelist, printkey, hivescan), and file-system artifacts (filescan, dumpfiles, mftscan), plus equivalent Linux (linux.pslist, linux.bash, linux.sockstat) and macOS (mac.pslist, mac.netstat) plugins. It gives end-to-end malware-analysis and incident-response workflows chaining these plugins - process survey, network connections, injection detection, suspicious-process dumping, string extraction, YARA scanning; and timeline, persistence, services, scheduled tasks, and recent-file review. It covers Windows kernel data structures relevant to manual analysis (EPROCESS, PEB, MMVAD), process-injection indicators (classic DLL injection, process hollowing, APC injection, thread-execution hijacking) and their memory signatures, rootkit detection by diffing pslist/psscan output and checking SSDT hooks, credential-artifact extraction plugins (hashdump, lsadump, cachedump), and example memory-scoped YARA rules (a generic injection-shellcode rule, a Cobalt Strike beacon-configuration rule) plus windows.yarascan usage across process, targeted-PID, and kernel memory. It covers string extraction (strings, Unicode strings, FLOSS for obfuscated strings) and a best-practices/pitfalls list: minimize acquisition footprint, hash the dump immediately, maintain chain of custody, cross-reference multiple plugins, and watch for stale data, incomplete dumps, wrong symbol files, memory smear, and in-memory encryption.

Use it for memory forensics tasks: acquiring and analyzing memory dumps for incident response, malware analysis, injection detection, rootkit detection, or credential-artifact extraction in a forensic context. It does not apply outside memory forensics - a different domain or tool is out of scope.

Inputs: a captured memory dump (raw, .vmem, .elf, or .lime format) and, for Windows analysis, the correct OS symbol table. Outputs: process/network/DLL/registry/filesystem artifact listings, injection and rootkit detection findings, extracted credential artifacts, YARA scan hits, and a documented, hashed acquisition with chain of custody.

Volatility 3 (vol), WinPmem/DumpIt/LiME/osxpmem for acquisition, YARA for memory-pattern scanning, and strings/FLOSS for string extraction.

rule Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}

Incident responders and forensic analysts examining memory dumps for malware, injection, persistence, or credential-theft artifacts who need correct Volatility plugin sequencing and detection patterns rather than ad hoc analysis.