mindmap
root((Memory Forensics Tools))
Volatility
pslist
psscan
netscan
malfind
dlllist
cmdline
Rekall
Process Analysis
Network Analysis
Kernel Analysis
WinDbg
Kernel Debugging
Driver Analysis
Redline
IOC Collection
Malware Hunting
FTK Imager
Memory Acquisition
DumpIt
RAM Capture
Magnet RAM Capture
Live Memory Collection
flowchart TD
A[Malware Incident] --> B[Memory Acquisition]
B --> C[Memory Dump Collection]
C --> D[Memory Framework Analysis]
D --> E[Process Analysis]
D --> F[Network Analysis]
D --> G[Persistence Analysis]
D --> H[Malware Artifact Analysis]
E --> E1[Running Processes]
E --> E2[Hidden Processes]
E --> E3[Injected Processes]
F --> F1[TCP Connections]
F --> F2[DNS Requests]
F --> F3[C2 Communication]
G --> G1[Registry Persistence]
G --> G2[Scheduled Tasks]
G --> G3[Services and Drivers]
H --> H1[DLL Injection]
H --> H2[Process Hollowing]
H --> H3[Reflective DLL Loading]
H --> H4[Shellcode Detection]
E3 --> I[IOC Extraction]
F3 --> I
G3 --> I
H4 --> I
I --> J[Threat Classification]
J --> K[Incident Report]
- LibVMI - LibVMI is a C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine by viewing its memory, trapping on hardware events, and accessing the vCPU registers. This is called virtual machine introspection.
- memflow - physical memory introspection framework.
- Volatility - An advanced memory forensics framework.
You can access the my awesome lists here
Contributions of any kind welcome, just follow the guidelines!
Thanks goes to these contributors!
