The first part of our malware compromise assessment is going to focus on uncovering malicious processes running in memory. This may be accomplished by running several plug-ins and processing the data for specific data. These are tried and true techniques that are incorporated in most memory examinations. Using plug-ins that will search both linked and on linked memory space and analyst can uncover malicious patterns.

Before we start building our volatility script let's take a look at how the first part of the script is going to run. This is not the entire script, only the first part that addresses identifying malicious process is running in memory. Through this example you will see how much time an anlayst can save by automating volatility processing in post processing tasks.

We are building our volatility script from scratch. The first step is to set up the script with the necessary information to allow our volatility plug-ins to run smoothly.

Identifying the operating system profile is the first step with volatility analysis. This module we will automate the process and allow the user to select the correct profile.

Pslist and Psscan may be used to search for linked and unlinked processes. In this module we will automate both processes.

With the introduction of windows credential guard on windows 10 enterprise and windows server 2016 came a new process, LSAISO .exe. This section provides background information for memory investigations.

Pstree maybe used to produce a hierarchical list of running processes. The results make the triage of parent-child relationships a bit easier. In this module we will automate the process.

Psxview maybe used to query several different sources about processes running in memory. This is an excellent resource to identify anomalous processes. In this module we will automate the process.

Now that we have produced psxview results, we will craft post-processing commands in our volatility script to quickly triage for notable data. The script is going to take often repeated methodology and automated it to produce a standardized refinement process that can save an analyst time.

Psscan results can be difficult to automate because much of the information and analyst will pivot off of will change from case to case. In this module you'll learn some of the things to focus on to quickly triage the results.

This section teaches how to use spreadsheet programs to create a cross comparison table for psscan and pslist results.

Now that we have produced pslist results, we will craft post-processing commands in our volatility script to quickly triage for notable data. In most every exam the triage of Windows core processes is part of the methodology. The script is going to take this often repeated methodology and automated it to produce a standardized refinement process that can save an analyst time.

This section goes over how to triage the Taskhost process for anomalies to find signs of malware compromise.

Pstree allows you to include results that show parent child relationships and a useful addition to the triage evidence.

A review of what we learned so far.

This module provides an overview of what you will learn in this section.

This module teaches you how to use volatility to run the malfind scan which produces output that may be used to identify shell code injected into processes.

This module teaches you how to use the "file" command on Malfind results to identify shell code injected into running processes .

This module teaches you how to use volatility to search for an extract drivers from a memory image.

This module teaches you how to use volatility to search for and extract DLL files from a memory image.

This module teaches you how to set up an automated malware scan against executables extracted from memory.

This module teaches you how to automatically hash files extracted from memory so that they may be more easily ingested by open source threat intelligence repositories for further triage.

A review of what we learned so far.

What you will learn in this section.

How to use the results from DLLLIST during a malware compromise assessment.

How to use the results from shimcache and shimcachemem during a malware compromise assessment.

How to use the results from MFTPARSER during a malware compromise assessment.

Review of the section.

Make sure your script is executable.

Let's run the script one more time and see it in action.

Thank you for checking out the SDF series, I hope you enjoyed the class. 

Thank you!