Prefetch and ShimCache Search for and parse prefetch file headers in memory: prefetchparser
vol.py -f memory.img prefetchparser
Read ShimCache stored in memory that hasn't been written to disk : shimcachemem
vol.py -f memory.img --output=csv --output-file=file.csv shimcachemem
Image Processing Image Identification: imageinfo
vol.py -f memory.img imageinfo
Hibernation File Conversion: imagecopy
vol.py -f hiberfil.sys -O hiberfil.raw --profile=xxx imagecopy
Registry and
Services Locate virtual addresses of registry hives: hivelist
vol.py -f memory.img --profile=xxx hivelist
Display everything within a specified registry key: printkey
vol.py -f memory.img --profile=xxx -K Reg\Key printkey
Scan memory for Windows Services: svcscan
vol.py -f memory.img svcscan -v
Compare services against a baseline of known good services: servicebl
vol.py -f memory.img -B baseline.img -U servicebl
Find persistence points through ASEPs: autoruns
vol.py -f memory.img autoruns
Passwords and
secrets Extract and decrypt cached credentials: hashdump
vol.py -f memory.img --profile=xxx hashdump -y VirtualAddrOfSysHive -s VirtualAddrOfSAM
Extract plaintext passwords: mimikatz
vol.py -f memory.img --porfile=xxx mimikatz
Dump LSA secrets from memory: lsadump
vol.py -f memory.img lsadump
Process Listing List all running processes: pslist
vol.py -f memory.img pslist
ShimCache
Tools Location - SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache Enumerate processes using pool tag scanning psscan
1. ShimCacheParser.py - read ShimCache stored in registry vol.py -f memory.img --profile=xxx psscan
2. AppCompatCacheParser.exe - Windows tool runs on live or offline
View the process listing in tree form: pstree
Windows Prefetch
vol.py -f memory.img --profile=xxx pstree
Location - C:\Windows\Prefetch
First executed = creation date of .pf file
Tools Last executed = last modification date of .pf file Comparison between pslist and psscan: pstotal
1. pf - parse Windows prefetch files vol.py -f memory.img --profile=xxx -C --output=dot --output-
2. PECmd - Windows tool to parse prefetch info file=pstotal.dot
Evidence of execution
Search for malicious processes based on predefined rules: malprocfind
vol.py -f memory.img malprocfind
Tools
1. rfc.pl - Parses the structure of the
Compare processes against a baseline of known good processes: processbl
file RecentFileCache.bcf (Windows 7)
vol.py -f memory.img --profile=xxx -B baseline.img processbl
Location - C:\Windows\AppCompat\Programs\RecentFileCache.bcf
Tools
1. AmCacheParser.exe - Windows tool to extract AmCache
info Artefacts on Disk Memory Analysis DLLs and other objects Display a process' loaded DLLs dlllist
Amcache.hve (Windows 8+)
Location - C:\Windows\AppCompat\Programs\Amcache.hve vol.py -f memory.img -p 1234 dlllist
Keys = Amcache.hve\Root\File{Volume GUID}##### Volatility
First executed = last modification time of key
Show SIDs for each process getsids
vol.py -f memory.img -p 1234 getsids
Windows List of all handles opened by a process handles
Forensics vol.py -f memory.img -p 1234 handles
Display process command-line arguments: cmdline
Tools vol.py -f memory.img cmdline
Volume Shadow Copy
1. vshadowinfo - Show all shadow copies in a disk image
2. vshadowmount - Mount all shadow copies to a mount
point Historical Data
Scan and print network info: netscan
vol.py -f memory.img --profile=xxx netscan
Network information
Mindmap created by:
Gaurav Jaisinghani Helps find hidden or injected code/DLLs in user mode memory: malfind
python vol.py -f zeus.vmem malfind -p 1724
Code Injection
Event IDs of interest: Powershell/Operational
Script start - 4105 List loaded DLLs unlinked by stealthy malware: ldrmodules
Script stop - 4106 vol.py -f memory.img -p 1234 ldrmodules
Script details - 4104
detect different types of process hollowing techniques: hollowfind
Event Logs vol.py -f infected.vmem --profile=xxx hollowfind
Location -%SystemRoot%\System32\winevt\logs
Event IDs of interest:
Service crashed unexpectedly - 7034
Windows Services
Service sent a Start/Stop message - 7035
Service started or stopped - 7036
Service start type changed - 7040 Show hooked functions withing SSDT: ssdt
Service was installed on system - 7045 vol.py -f memory.img ssdt
Rootkit Detection
System Helps detect hidden processes by comparing seven different process listing plugins: psxview
Event IDs of interest: vol.py -f memory.img psxview
Audit log cleared - 104
Clearing tracks
Identify kernel drivers loaded: modules
vol.py -f memory.img modules
Event IDs of interest:
App Installation Compare loaded kernel drivers against a baseline of known good drivers: driverbl
Installation complete - 1033/11707
Application removal completed - 1034/11724 vol.py -f memory.img -B baseline.img driverbl
Application
Installation failed - 11708
Find API hooks in user mode or kernel mode: apihooks
vol.py -f memory.img apihooks
Event IDs of interest
Scheduled task created - 4698/106 Print the system's IDT: idt
Scheduled task updated - 4702/140 Scheduled Tasks vol.py -f memory.img idt
Scheduled task deleted - 4699/141
Scheduled task executed - 200/201
Scheduled task enabled - 4700
Scheduled tasks disabled - 4701
DLL: dlldump
Event IDs of interest: Network Shares vol.py -f memory.img dlldump
Network share accessed - 5140
Extraction and carving
Network share object checked for access - 5145
Kernel drivers: moddump
vol.py -f memory.img --dump-dir=/path/to/dir moddump
Event IDs of interest:
Logon successful - 4624
Logon failed - 4625 Process: procdump
Account Usage
Logoff Successful - 4634/4647 vol.py -f memory.img -p 1234 --dump-dir=/path/to/dir procdump
Explicit credentials used to logon (RunAs) - 4648
Account logon with admin privileges- 4672 Security
Account creation - 4720
Successful/Failed local authentication - 4776 Memory section: memdump
vol.py -f memory.img -p 1234 --dump-dir=/path/to/dir memdump
Event IDs of interest:
Remote session connected/reconnected - 4778
Remote session disconnected - 4779 Remote Sessions Command history: cmdscan
vol.py -f memory.img --profile=xxxx cmdscan
Event IDs of interest
TGT was granted - 4768
Service ticket requested - 4769
Console information with screen buffer: consoles
Pre-authentication failed - 4771
Kerberos (AD accounts) vol.py -f memory.img consoles
Scan files: filescan
Event IDs of interest: vol.py -f memory.img filescan
Service was installed on system - 4697
Windows Services
Files cached in memory: dumpfiles
vol.py -f memory.img --dump-dir=/path-to/dir dumpfiles
Event IDs of interest:
New process created - 4688
Command Line
Registry hives: dumpregistry
vol.py -f memory.img --profile=xxx --dump-dir=/path/to/dir dumpregistry
Event IDs of interest:
Audit log cleared - 1102
Clearing tracks
