Windows memory analysis with Volatility 3
You examine processes, command lines, loaded DLLs, handles, network connections and the in-memory registry in Windows dumps with Volatility 3, and single out the suspicious process with evidence.
Level 301 · 18 lessons · 15 practice labs
Lessons
Getting started
- Capturing Windows memory: winpmem, DumpIt and VM snapshots
- windows.info and symbol tables
- EPROCESS and the process list: how Windows keeps track
- Short task: determine the OS build and capture time of a dump
Processes
- windows.pslist and windows.pstree: what a normal process tree looks like
- Finding unlinked processes with windows.psscan
- Execution context with windows.cmdline and windows.envars
- Suspicious loads and open objects with windows.dlllist and windows.handles
- Short task: find the svchost spawned by the wrong parent
Network, registry and code
- Linking connections to processes with windows.netscan
- The in-memory registry with windows.registry.hivelist and printkey
- Suspicious executable memory regions with windows.malfind
- Dumping suspicious files and process memory
- Examining services with windows.svcscan
- Short task: scan the region you dumped with YARA
Reporting
- Confirming a memory finding with disk and event logs
- Reporting memory findings with times and evidence
- Capstone: pull every piece of the attack out of a workstation dump
Practice labs
- Determine the dump's version and capture time: Extract the operating system version and the dump's capture time with windows.info.
- Solve a symbol table problem: Supply the right table for a dump that fails for missing symbols and show it parses.
- Compare the acquisition methods: Compare prepared dumps taken with a memory tool and a virtual machine snapshot for consistency and smear.
- Know the normal process tree: Produce the process tree of a clean dump with pslist and pstree and write the expected parents.
- The svchost born from the wrong parent: Find the svchost spawned by an unexpected parent and verify its path.
- Find the process unlinked from the list: Compare pslist and psscan results to identify the process visible only in the scan.
- Read the command lines: List the suspicious processes' command lines with windows.cmdline.
- Environment variables and loaded DLLs: Find a process's working directory and the library loaded from an unusual path with envars and dlllist.
- Work out what a process does from its handles: Justify a process's purpose from its open file, key and mutex objects with windows.handles.
- Tie connections to processes: List the outbound connections with their owning processes using windows.netscan.
- Read the registry in memory: Read the in-memory Run key with hivelist and printkey and find the persistence entry.
- Dump the suspicious region and scan it with YARA: Dump the region malfind points at, scan it with YARA and look for its counterpart in the service list with svcscan.
- Write a memory finding with evidence: Write up one finding documenting the plugin name, command and output line.
- Corroborate a finding with disk and event log: Show the trace of a process found in memory in Prefetch and in a process creation event.
- The pieces of the attack from a workstation dump: From Lavinya Klinikleri's prepared workstation dump report execution, persistence and connection findings in time order.
About this course
You examine processes, command lines, loaded DLLs, handles, network connections and the in-memory registry in Windows dumps with Volatility 3, and single out the suspicious process with evidence.
What you will learn
- Getting started
- Processes
- Network, registry and code
- Reporting
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.