Hyrje në Forensikën e Memories

Memory forensics examines the contents of a system's RAM to find artifacts that never touch disk.

Fileless malware, running processes, network connections, loaded DLLs, open handles, credentials cached in memory, and encryption keys all live in RAM and are typically gone after a reboot. Capturing a full RAM image while the system is still running — via WinPMem, DumpIt or LiME on Linux — gives the analyst a frozen snapshot of everything the OS knows about itself at that instant. The standard analysis framework is Volatility (now Volatility 3), an open-source Python tool maintained by the Volatility Foundation. Volatility parses the memory image using plugins: pslist and psscan to list processes, netscan for connections, cmdline for command lines, hashdump for local password hashes, malfind to find injected code regions, and dozens more. Each plugin walks the OS-specific data structures inside the memory image. Because kernel structures change between Windows and Linux versions, Volatility relies on "symbol tables" that describe each supported OS. Modern Volatility 3 uses a rich symbol format that can be automatically generated for a specific kernel build. Memory forensics has a steep learning curve but is unmatched for detecting stealthy attackers who go out of their way to leave no disk footprint.

Mjete:

• Volatility 3 — analizë RAM cross-platform.
• Rekall (inactive por ende i përdorur).
• winpmem, dumpit, LiME (Linux) — acquisition.

Kapje e RAM-it në Linux:

insmod lime.ko "path=/evidence/mem.lime format=lime"

Analizë me Volatility 3:

vol -f mem.lime linux.pslist
vol -f mem.lime linux.bash
vol -f mem.lime linux.malfind

1. Kap RAM-in e një VM Linux dhe gjej procesin me komandën më të fundit në bash history.
2. Gjej një reverse shell të injektuar (preferohet lab PoC).

• Volatility Foundation docs.
• SANS FOR526 — Memory Forensics.