Discover and read the best of Twitter Threads about #MemoryForensics
Most recents (1)
1\ How to detect what command line spawned a process with no EDR/AV? 👀 #DFIR
If you have a memory sample, this is how you can figure out what cmd spawned the processes by using volshell and memory forensics.
STEP BY STEP GUIDE BELOW
👇 👇 👇 👇Â
#MemoryForensics
If you have a memory sample, this is how you can figure out what cmd spawned the processes by using volshell and memory forensics.
STEP BY STEP GUIDE BELOW
👇 👇 👇 👇Â
#MemoryForensics
2\ Each process in Windows is represented by an "EPROCESS" structure.
These EPROCESS blocks are joined in a doubly linked list structure. The flink (forward link) tells you the next process running and blink (backwards link) tells you the previous process.
These EPROCESS blocks are joined in a doubly linked list structure. The flink (forward link) tells you the next process running and blink (backwards link) tells you the previous process.
3\ When you see a list of processes on a live system, often times this is gathered by walking this doubly-linked structure of EPROCESS blocks.
Of course malware can unlink a process in this doubly linked list to hide from detection :P
Of course malware can unlink a process in this doubly linked list to hide from detection :P
