Advanced memory analysis: injection, hiding and Linux memory
You catch code injection, process hollowing and hidden processes in memory, go deeper into Linux dumps with Volatility and sweep memory with YARA rules.
Level 401 · 14 lessons · 12 practice labs
Lessons
Injection and hollowing
- Code injection types: what defenders need to know
- The VAD tree and memory protection flags
- Detecting process hollowing: the difference between disk and memory images
- Reflective loading and DLLs not on disk: ldrmodules
- Short task: find the injected region and prove where it came from
Hiding and credentials
- Finding hidden objects with pool scanning
- Process tokens and privileges: windows.privileges
- Credential traces in memory and detecting LSASS access
- Short task: identify the process that accessed LSASS
Linux memory and YARA
- Hidden processes and kernel modules in Linux dumps
- Sweeping memory with rules using yarascan
- Comparing with a clean baseline dump
- Processing many dumps with scripts
- Capstone: prove a fileless attack from memory alone
Practice labs
- Read protection flags in the VAD tree: List a process's memory regions and mark those that are both writable and executable.
- Find the injected region: Find the executable region with no backing file in a prepared dump and show its content header.
- Prove the source of the injection: Tie the injected region to its source process through handles and process relationships.
- Compare the loaded module lists: Find the library missing from one of three lists with ldrmodules.
- The difference between image on disk and in memory: Dump a process's in-memory image and compare it with the hash of the file on disk.
- Detect the hollowed process: Combine parent process, command line and image difference evidence to identify the hollowed process with reasoning.
- List the process privileges: List the processes with the debug privilege enabled using windows.privileges.
- Identify the process accessing LSASS: Find the process holding access to the authentication process from handle records and write the detection criterion.
- Find hidden objects with pool scanning: Compare the output of list-walking and pool-scanning plugins and report the objects seen only by scanning.
- Scan memory with YARA rules: Scan the dump with a ready rule set and list the matching processes.
- Compare against a clean reference dump: Compare the suspect dump with a clean reference and extract the extra processes and modules.
- Prove a fileless incident from memory alone: In Yakamoz Telekom's prepared dump expose the activity that left no trace on disk with process, region and connection evidence, scanning ten dumps by script.
About this course
You catch code injection, process hollowing and hidden processes in memory, go deeper into Linux dumps with Volatility and sweep memory with YARA rules.
What you will learn
- Injection and hollowing
- Hiding and credentials
- Linux memory and YARA
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.