Find malware traces in Windows and Linux memory.
What it does
Guides memory-dump investigations to uncover malware indicators, recover credentials and files, and reconstruct incident timelines.
When to use it
Use when analyzing memory dumps for malware, credentials, suspicious processes, code injection, or incident timelines.
How to use it
Give it a memory dump; it returns forensic evidence and can save extracted files or an incident timeline.
What you provide
- Your files
Latest review
What you need · 1
Requires Volatility 2 or 3 for the memory-analysis workflow; the playbook provides commands for both.
Access · 0
No additional actions listed.