detecting-process-injection-in-memory

Name: detecting-process-injection-in-memory
Author: meltedinhex

18stars5forks

How to install detecting-process-injection-in-memory?

meltedinhex/analyst-ai-pack/detecting-process-injection-in-memory

$npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-process-injection-in-memory

Installs into the current project.

Summary

Detects process injection in a memory image by identifying private executable regions

Files · 1

View on GitHub

SKILL.md

1	# Detecting Process Injection in Memory
2
3	## When to Use
4
5	- You have a Windows memory image and want to find injected/hollowed code.
6	- You are triaging private RWX regions, unbacked executable memory, and PE headers in private
7	allocations (classic injection/hollowing signs).
8
9	Do not use this on a live production host without authorization — work from an acquired image.
10	This skill interprets analysis output; run Volatility separately on the image.
11
12	## Prerequisites
13
14	- A memory image and Volatility 3 (`windows.malfind`, `windows.vadinfo`) installed.
15
16	## Safety & Handling
17
18	- Treat carved injected regions as live malicious code; store them password-protected.
19
20	## Workflow
21
22	### Step 1: Run malfind and capture output
23
24	```bash
25	vol -f memory.raw windows.malfind > malfind.txt
26	```
27
28	### Step 2: Score injection candidates
29
30	```bash
31	python scripts/analyst.py score malfind.txt
32	```
33
34	Flags regions with `PAGE_EXECUTE_READWRITE`, MZ/PE headers in private memory, and shellcode-like
35	disassembly hints, ranking processes by suspicion.
36
37	### Step 3: Corroborate
38
39	Cross-check flagged PIDs with `windows.vadinfo` (private, executable, no mapped file) and the
40	process tree for anomalous parents.
41
42	### Step 4: Carve and route
43
44	Carve the injected region for follow-on shellcode/PE recovery and analysis.
45
46	## Validation
47
48	- Flagged regions are private + executable, not legitimate mapped images.
49	- PE-in-private-memory findings are confirmed by an MZ/`This program` signature.
50	- High-scoring PIDs corroborate with VAD protections and process-tree anomalies.
51
52	## Pitfalls
53
54	- JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
55	- Relying on malfind alone; pair with vadinfo and ldrmodules.
56	- Missing hollowing where the region is RX (not RWX) after protection change.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the scorer.
61	- ATT&CK T1055 and Volatility 3 docs (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

detecting-process-injection-in-memory

18stars5forks

View on GitHub

How to install detecting-process-injection-in-memory?

meltedinhex/analyst-ai-pack/detecting-process-injection-in-memory

$npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-process-injection-in-memory

Installs into the current project.

Summary

Detects process injection in a memory image by identifying private executable regions

Files · 1

View on GitHub

SKILL.md

1	# Detecting Process Injection in Memory
2
3	## When to Use
4
5	- You have a Windows memory image and want to find injected/hollowed code.
6	- You are triaging private RWX regions, unbacked executable memory, and PE headers in private
7	allocations (classic injection/hollowing signs).
8
9	Do not use this on a live production host without authorization — work from an acquired image.
10	This skill interprets analysis output; run Volatility separately on the image.
11
12	## Prerequisites
13
14	- A memory image and Volatility 3 (`windows.malfind`, `windows.vadinfo`) installed.
15
16	## Safety & Handling
17
18	- Treat carved injected regions as live malicious code; store them password-protected.
19
20	## Workflow
21
22	### Step 1: Run malfind and capture output
23
24	```bash
25	vol -f memory.raw windows.malfind > malfind.txt
26	```
27
28	### Step 2: Score injection candidates
29
30	```bash
31	python scripts/analyst.py score malfind.txt
32	```
33
34	Flags regions with `PAGE_EXECUTE_READWRITE`, MZ/PE headers in private memory, and shellcode-like
35	disassembly hints, ranking processes by suspicion.
36
37	### Step 3: Corroborate
38
39	Cross-check flagged PIDs with `windows.vadinfo` (private, executable, no mapped file) and the
40	process tree for anomalous parents.
41
42	### Step 4: Carve and route
43
44	Carve the injected region for follow-on shellcode/PE recovery and analysis.
45
46	## Validation
47
48	- Flagged regions are private + executable, not legitimate mapped images.
49	- PE-in-private-memory findings are confirmed by an MZ/`This program` signature.
50	- High-scoring PIDs corroborate with VAD protections and process-tree anomalies.
51
52	## Pitfalls
53
54	- JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
55	- Relying on malfind alone; pair with vadinfo and ldrmodules.
56	- Missing hollowing where the region is RX (not RWX) after protection change.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the scorer.
61	- ATT&CK T1055 and Volatility 3 docs (linked in frontmatter).

People who liked this also viewed

6 picks

Type