VOLATILITY
Volatility is a memory forensics framework. Essential for analyzing RAM dumps and detecting malware.
INSTALLATION#
# Volatility 3 (Python 3) pip install volatility3 # Or from source git clone https://github.com/volatilityfoundation/volatility3 cd volatility3 pip install -r requirements.txt
BASIC USAGE#
VOLATILITY 3 SYNTAX#
vol -f memory.dmp <plugin> vol -f memory.dmp windows.info vol -f memory.dmp -o output_dir windows.pslist
VOLATILITY 2 SYNTAX#
vol.py -f memory.dmp --profile=Win7SP1x64 <plugin> vol.py -f memory.dmp imageinfo # Detect profile
IDENTIFY MEMORY IMAGE#
VOLATILITY 3#
vol -f memory.dmp windows.info vol -f memory.dmp banners.Banners
VOLATILITY 2#
vol.py -f memory.dmp imageinfo vol.py -f memory.dmp kdbgscan
PROCESS ANALYSIS#
LIST PROCESSES#
# Vol3 vol -f memory.dmp windows.pslist vol -f memory.dmp windows.psscan # Find hidden vol -f memory.dmp windows.pstree # Tree view # Vol2 vol.py -f memory.dmp --profile=X pslist vol.py -f memory.dmp --profile=X psscan vol.py -f memory.dmp --profile=X pstree
PROCESS DETAILS#
# Vol3 vol -f memory.dmp windows.cmdline # Command lines vol -f memory.dmp windows.dlllist # Loaded DLLs vol -f memory.dmp windows.handles # Open handles vol -f memory.dmp windows.privs # Privileges # Vol2 vol.py -f memory.dmp --profile=X cmdline vol.py -f memory.dmp --profile=X dlllist vol.py -f memory.dmp --profile=X handles vol.py -f memory.dmp --profile=X privs
DUMP PROCESS#
# Vol3 vol -f memory.dmp -o dump/ windows.pslist --pid 1234 --dump vol -f memory.dmp -o dump/ windows.memmap --pid 1234 --dump # Vol2 vol.py -f memory.dmp --profile=X procdump -p 1234 -D dump/ vol.py -f memory.dmp --profile=X memdump -p 1234 -D dump/
NETWORK ANALYSIS#
CONNECTIONS#
# Vol3 vol -f memory.dmp windows.netstat vol -f memory.dmp windows.netscan # Vol2 vol.py -f memory.dmp --profile=X netscan vol.py -f memory.dmp --profile=X connections # XP only vol.py -f memory.dmp --profile=X connscan # XP only
MALWARE DETECTION#
CODE INJECTION#
# Vol3 vol -f memory.dmp windows.malfind vol -f memory.dmp windows.vadinfo # Vol2 vol.py -f memory.dmp --profile=X malfind vol.py -f memory.dmp --profile=X vadinfo
HIDDEN/INJECTED#
# Vol3 vol -f memory.dmp windows.ldrmodules # Unlinked DLLs vol -f memory.dmp windows.hollowprocesses # Vol2 vol.py -f memory.dmp --profile=X ldrmodules vol.py -f memory.dmp --profile=X hollowfind
ROOTKIT DETECTION#
# Vol2 vol.py -f memory.dmp --profile=X psxview vol.py -f memory.dmp --profile=X ssdt vol.py -f memory.dmp --profile=X driverirp vol.py -f memory.dmp --profile=X callbacks vol.py -f memory.dmp --profile=X idt vol.py -f memory.dmp --profile=X gdt
REGISTRY ANALYSIS#
HIVES#
# Vol3 vol -f memory.dmp windows.registry.hivelist vol -f memory.dmp windows.registry.printkey # Vol2 vol.py -f memory.dmp --profile=X hivelist vol.py -f memory.dmp --profile=X hivedump
KEYS AND VALUES#
# Vol3 vol -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run" # Vol2 vol.py -f memory.dmp --profile=X printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"
USER CREDENTIALS#
# Vol3 vol -f memory.dmp windows.hashdump vol -f memory.dmp windows.cachedump vol -f memory.dmp windows.lsadump # Vol2 vol.py -f memory.dmp --profile=X hashdump vol.py -f memory.dmp --profile=X cachedump vol.py -f memory.dmp --profile=X lsadump
FILE ANALYSIS#
FILE SCAN#
# Vol3 vol -f memory.dmp windows.filescan # Vol2 vol.py -f memory.dmp --profile=X filescan
DUMP FILES#
# Vol3 vol -f memory.dmp -o dump/ windows.dumpfiles --physaddr 0x12345678 # Vol2 vol.py -f memory.dmp --profile=X dumpfiles -Q 0x12345678 -D dump/
MFT#
# Vol2 vol.py -f memory.dmp --profile=X mftparser
TIMELINE#
# Vol3 vol -f memory.dmp timeliner.Timeliner # Vol2 vol.py -f memory.dmp --profile=X timeliner --output-file timeline.csv
SERVICES AND DRIVERS#
SERVICES#
# Vol3 vol -f memory.dmp windows.svcscan # Vol2 vol.py -f memory.dmp --profile=X svcscan
DRIVERS#
# Vol3 vol -f memory.dmp windows.driverscan vol -f memory.dmp windows.modules # Vol2 vol.py -f memory.dmp --profile=X driverscan vol.py -f memory.dmp --profile=X modules vol.py -f memory.dmp --profile=X modscan
USER ACTIVITY#
CLIPBOARD#
# Vol2 vol.py -f memory.dmp --profile=X clipboard
CONSOLE HISTORY#
# Vol3 vol -f memory.dmp windows.cmdline # Vol2 vol.py -f memory.dmp --profile=X consoles vol.py -f memory.dmp --profile=X cmdscan
BROWSER HISTORY#
# Vol2 vol.py -f memory.dmp --profile=X iehistory
SCREENSHOT#
# Vol2 vol.py -f memory.dmp --profile=X screenshot -D screenshots/
STRINGS ANALYSIS#
# Extract strings then search in Vol strings -a memory.dmp > strings.txt vol -f memory.dmp windows.strings --strings-file strings.txt
YARA SCANNING#
# Vol3 vol -f memory.dmp yarascan.YaraScan --yara-file rules.yar # Vol2 vol.py -f memory.dmp --profile=X yarascan -Y "rule_name" vol.py -f memory.dmp --profile=X yarascan -y rules.yar
LINUX MEMORY#
# Vol3 vol -f memory.dmp linux.bash vol -f memory.dmp linux.pslist vol -f memory.dmp linux.pstree vol -f memory.dmp linux.lsof vol -f memory.dmp linux.netstat
MAC MEMORY#
# Vol3 vol -f memory.dmp mac.pslist vol -f memory.dmp mac.pstree vol -f memory.dmp mac.netstat vol -f memory.dmp mac.bash
COMMON WORKFLOWS#
INITIAL TRIAGE#
vol -f memory.dmp windows.info vol -f memory.dmp windows.pslist vol -f memory.dmp windows.pstree vol -f memory.dmp windows.netscan vol -f memory.dmp windows.malfind
MALWARE HUNT#
vol -f memory.dmp windows.malfind vol -f memory.dmp windows.ldrmodules vol -f memory.dmp windows.hollowprocesses vol -f memory.dmp yarascan.YaraScan --yara-file malware.yar
CREDENTIAL EXTRACTION#
vol -f memory.dmp windows.hashdump vol -f memory.dmp windows.cachedump vol -f memory.dmp windows.lsadump
QUICK REFERENCE#
vol -f mem.dmp windows.info # Image info vol -f mem.dmp windows.pslist # Process list vol -f mem.dmp windows.pstree # Process tree vol -f mem.dmp windows.netscan # Network vol -f mem.dmp windows.malfind # Injected code vol -f mem.dmp windows.cmdline # Command lines vol -f mem.dmp windows.filescan # Files in memory vol -f mem.dmp windows.hashdump # Password hashes vol -f mem.dmp windows.registry.hivelist # Registry hives vol -f mem.dmp -o out/ windows.pslist --dump # Dump process
VOLATILITY CHEATSHEET ===================== Source: https://cheatsheet.johlem.net Volatility is a memory forensics framework. Essential for analyzing RAM dumps and detecting malware. INSTALLATION ------------ # Volatility 3 (Python 3) pip install volatility3 # Or from source git clone https://github.com/volatilityfoundation/volatility3 cd volatility3 pip install -r requirements.txt BASIC USAGE =========== VOLATILITY 3 SYNTAX ------------------- vol -f memory.dmp <plugin> vol -f memory.dmp windows.info vol -f memory.dmp -o output_dir windows.pslist VOLATILITY 2 SYNTAX ------------------- vol.py -f memory.dmp --profile=Win7SP1x64 <plugin> vol.py -f memory.dmp imageinfo # Detect profile IDENTIFY MEMORY IMAGE ===================== VOLATILITY 3 ------------ vol -f memory.dmp windows.info vol -f memory.dmp banners.Banners VOLATILITY 2 ------------ vol.py -f memory.dmp imageinfo vol.py -f memory.dmp kdbgscan PROCESS ANALYSIS ================ LIST PROCESSES -------------- # Vol3 vol -f memory.dmp windows.pslist vol -f memory.dmp windows.psscan # Find hidden vol -f memory.dmp windows.pstree # Tree view # Vol2 vol.py -f memory.dmp --profile=X pslist vol.py -f memory.dmp --profile=X psscan vol.py -f memory.dmp --profile=X pstree PROCESS DETAILS --------------- # Vol3 vol -f memory.dmp windows.cmdline # Command lines vol -f memory.dmp windows.dlllist # Loaded DLLs vol -f memory.dmp windows.handles # Open handles vol -f memory.dmp windows.privs # Privileges # Vol2 vol.py -f memory.dmp --profile=X cmdline vol.py -f memory.dmp --profile=X dlllist vol.py -f memory.dmp --profile=X handles vol.py -f memory.dmp --profile=X privs DUMP PROCESS ------------ # Vol3 vol -f memory.dmp -o dump/ windows.pslist --pid 1234 --dump vol -f memory.dmp -o dump/ windows.memmap --pid 1234 --dump # Vol2 vol.py -f memory.dmp --profile=X procdump -p 1234 -D dump/ vol.py -f memory.dmp --profile=X memdump -p 1234 -D dump/ NETWORK ANALYSIS ================ CONNECTIONS ----------- # Vol3 vol -f memory.dmp windows.netstat vol -f memory.dmp windows.netscan # Vol2 vol.py -f memory.dmp --profile=X netscan vol.py -f memory.dmp --profile=X connections # XP only vol.py -f memory.dmp --profile=X connscan # XP only MALWARE DETECTION ================= CODE INJECTION -------------- # Vol3 vol -f memory.dmp windows.malfind vol -f memory.dmp windows.vadinfo # Vol2 vol.py -f memory.dmp --profile=X malfind vol.py -f memory.dmp --profile=X vadinfo HIDDEN/INJECTED --------------- # Vol3 vol -f memory.dmp windows.ldrmodules # Unlinked DLLs vol -f memory.dmp windows.hollowprocesses # Vol2 vol.py -f memory.dmp --profile=X ldrmodules vol.py -f memory.dmp --profile=X hollowfind ROOTKIT DETECTION ----------------- # Vol2 vol.py -f memory.dmp --profile=X psxview vol.py -f memory.dmp --profile=X ssdt vol.py -f memory.dmp --profile=X driverirp vol.py -f memory.dmp --profile=X callbacks vol.py -f memory.dmp --profile=X idt vol.py -f memory.dmp --profile=X gdt REGISTRY ANALYSIS ================= HIVES ----- # Vol3 vol -f memory.dmp windows.registry.hivelist vol -f memory.dmp windows.registry.printkey # Vol2 vol.py -f memory.dmp --profile=X hivelist vol.py -f memory.dmp --profile=X hivedump KEYS AND VALUES --------------- # Vol3 vol -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run" # Vol2 vol.py -f memory.dmp --profile=X printkey -K "Software\Microsoft\Windows\CurrentVersion\Run" USER CREDENTIALS ---------------- # Vol3 vol -f memory.dmp windows.hashdump vol -f memory.dmp windows.cachedump vol -f memory.dmp windows.lsadump # Vol2 vol.py -f memory.dmp --profile=X hashdump vol.py -f memory.dmp --profile=X cachedump vol.py -f memory.dmp --profile=X lsadump FILE ANALYSIS ============= FILE SCAN --------- # Vol3 vol -f memory.dmp windows.filescan # Vol2 vol.py -f memory.dmp --profile=X filescan DUMP FILES ---------- # Vol3 vol -f memory.dmp -o dump/ windows.dumpfiles --physaddr 0x12345678 # Vol2 vol.py -f memory.dmp --profile=X dumpfiles -Q 0x12345678 -D dump/ MFT --- # Vol2 vol.py -f memory.dmp --profile=X mftparser TIMELINE ======== # Vol3 vol -f memory.dmp timeliner.Timeliner # Vol2 vol.py -f memory.dmp --profile=X timeliner --output-file timeline.csv SERVICES AND DRIVERS ==================== SERVICES -------- # Vol3 vol -f memory.dmp windows.svcscan # Vol2 vol.py -f memory.dmp --profile=X svcscan DRIVERS ------- # Vol3 vol -f memory.dmp windows.driverscan vol -f memory.dmp windows.modules # Vol2 vol.py -f memory.dmp --profile=X driverscan vol.py -f memory.dmp --profile=X modules vol.py -f memory.dmp --profile=X modscan USER ACTIVITY ============= CLIPBOARD --------- # Vol2 vol.py -f memory.dmp --profile=X clipboard CONSOLE HISTORY --------------- # Vol3 vol -f memory.dmp windows.cmdline # Vol2 vol.py -f memory.dmp --profile=X consoles vol.py -f memory.dmp --profile=X cmdscan BROWSER HISTORY --------------- # Vol2 vol.py -f memory.dmp --profile=X iehistory SCREENSHOT ---------- # Vol2 vol.py -f memory.dmp --profile=X screenshot -D screenshots/ STRINGS ANALYSIS ================ # Extract strings then search in Vol strings -a memory.dmp > strings.txt vol -f memory.dmp windows.strings --strings-file strings.txt YARA SCANNING ============= # Vol3 vol -f memory.dmp yarascan.YaraScan --yara-file rules.yar # Vol2 vol.py -f memory.dmp --profile=X yarascan -Y "rule_name" vol.py -f memory.dmp --profile=X yarascan -y rules.yar LINUX MEMORY ============ # Vol3 vol -f memory.dmp linux.bash vol -f memory.dmp linux.pslist vol -f memory.dmp linux.pstree vol -f memory.dmp linux.lsof vol -f memory.dmp linux.netstat MAC MEMORY ========== # Vol3 vol -f memory.dmp mac.pslist vol -f memory.dmp mac.pstree vol -f memory.dmp mac.netstat vol -f memory.dmp mac.bash COMMON WORKFLOWS ================ INITIAL TRIAGE -------------- vol -f memory.dmp windows.info vol -f memory.dmp windows.pslist vol -f memory.dmp windows.pstree vol -f memory.dmp windows.netscan vol -f memory.dmp windows.malfind MALWARE HUNT ------------ vol -f memory.dmp windows.malfind vol -f memory.dmp windows.ldrmodules vol -f memory.dmp windows.hollowprocesses vol -f memory.dmp yarascan.YaraScan --yara-file malware.yar CREDENTIAL EXTRACTION --------------------- vol -f memory.dmp windows.hashdump vol -f memory.dmp windows.cachedump vol -f memory.dmp windows.lsadump QUICK REFERENCE --------------- vol -f mem.dmp windows.info # Image info vol -f mem.dmp windows.pslist # Process list vol -f mem.dmp windows.pstree # Process tree vol -f mem.dmp windows.netscan # Network vol -f mem.dmp windows.malfind # Injected code vol -f mem.dmp windows.cmdline # Command lines vol -f mem.dmp windows.filescan # Files in memory vol -f mem.dmp windows.hashdump # Password hashes vol -f mem.dmp windows.registry.hivelist # Registry hives vol -f mem.dmp -o out/ windows.pslist --dump # Dump process
Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.