ineedcodes 1.6.1 → 1.7.0

package/skills/memory-forensics-volatility/SKILL.md

@@ -0,0 +1,323 @@
+---
+name: memory-forensics-volatility
+description: >-
+  Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.gated: true
+---
+
+# SKILL: Memory Forensics — Expert Analysis Playbook
+
+> **AI LOAD INSTRUCTION**: Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) for correlating network artifacts with memory findings
+- [steganography-techniques](../steganography-techniques/SKILL.md) if hidden data suspected in extracted files
+- [windows-privilege-escalation](../windows-privilege-escalation/SKILL.md) for understanding post-exploitation artifacts in memory
+
+### Quick Reference
+
+Also load [VOLATILITY_CHEATSHEET.md](./VOLATILITY_CHEATSHEET.md) when you need:
+- Vol2 vs Vol3 command comparison table
+- Common plugin sequences for specific investigation types
+
+---
+
+## 1. MEMORY ACQUISITION
+
+### Linux
+
+```bash
+# LiME (Linux Memory Extractor) — kernel module
+insmod lime.ko "path=/tmp/mem.lime format=lime"
+
+# /proc/kcore (if available)
+dd if=/proc/kcore of=/tmp/mem.raw bs=1M
+
+# AVML (Microsoft's open-source)
+./avml /tmp/mem.lime
+```
+
+### Windows
+
+```bash
+# WinPmem
+winpmem_mini_x64.exe memdump.raw
+
+# FTK Imager (GUI) — capture memory to file
+
+# DumpIt (single-click memory dump)
+DumpIt.exe
+
+# Comae (MagnetRAM)
+MagnetRAMCapture.exe /output memdump.raw
+```
+
+### Virtual Machines
+
+```bash
+# VMware: .vmem file in VM directory (suspend VM first)
+# VirtualBox: VBoxManage debugvm "VM_NAME" dumpvmcore --filename mem.raw
+# KVM/QEMU: virsh dump DOMAIN memdump --memory-only
+# Hyper-V: checkpoint VM → inspect .bin files
+```
+
+---
+
+## 2. VOLATILITY 2 vs 3
+
+| Concept | Volatility 2 | Volatility 3 |
+|---|---|---|
+| Profile system | `--profile=Win10x64_19041` | Auto-detected (symbol tables) |
+| Image info | `imageinfo` | `windows.info` / `linux.info` |
+| Process list | `pslist` | `windows.pslist` |
+| Network | `netscan` / `connections` | `windows.netscan` / `windows.netstat` |
+| DLLs | `dlllist` | `windows.dlllist` |
+| Injection | `malfind` | `windows.malfind` |
+| Hashes | `hashdump` | `windows.hashdump` |
+| Files | `filescan` | `windows.filescan` |
+| Registry | `hivelist` / `printkey` | `windows.registry.hivelist` / `windows.registry.printkey` |
+| Install | `pip2 install volatility` | `pip3 install volatility3` |
+
+---
+
+## 3. ANALYSIS METHODOLOGY
+
+### Step 1: Identify OS
+
+```bash
+# Vol2
+vol.py -f mem.raw imageinfo
+vol.py -f mem.raw kdbgscan
+
+# Vol3
+vol -f mem.raw windows.info
+vol -f mem.raw banners.Banners
+```
+
+### Step 2: Process Listing — Hidden Process Detection
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE pslist       # EPROCESS linked list
+vol.py -f mem.raw --profile=PROFILE psscan       # pool tag scan (finds unlinked)
+vol.py -f mem.raw --profile=PROFILE pstree       # parent-child hierarchy
+
+# Vol3
+vol -f mem.raw windows.pslist
+vol -f mem.raw windows.psscan
+vol -f mem.raw windows.pstree
+```
+
+**Red flags**: Process in `psscan` but not `pslist` = DKOM (Direct Kernel Object Manipulation) hiding.
+
+### Step 3: Network Connections
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE netscan      # TCP/UDP endpoints
+vol.py -f mem.raw --profile=PROFILE connections   # XP/2003 only
+vol.py -f mem.raw --profile=PROFILE connscan      # closed connections
+
+# Vol3
+vol -f mem.raw windows.netscan
+vol -f mem.raw windows.netstat
+```
+
+### Step 4: DLL / Module Analysis
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE dlllist -p PID
+vol.py -f mem.raw --profile=PROFILE ldrmodules -p PID   # find unlinked DLLs
+
+# Vol3
+vol -f mem.raw windows.dlllist --pid PID
+```
+
+**Red flags**: DLL in `dlllist` but `False` in all three `ldrmodules` columns = reflective DLL injection.
+
+### Step 5: Code Injection Detection (Malfind)
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE malfind -p PID
+vol.py -f mem.raw --profile=PROFILE malfind -D /tmp/dump/   # dump injected sections
+
+# Vol3
+vol -f mem.raw windows.malfind --pid PID
+```
+
+**What malfind detects**: Memory regions with `PAGE_EXECUTE_READWRITE` that don't map to a file on disk — classic shellcode/injection indicator.
+
+### Step 6: Credential Extraction
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE hashdump      # SAM hashes
+vol.py -f mem.raw --profile=PROFILE lsadump       # LSA secrets
+vol.py -f mem.raw --profile=PROFILE cachedump     # domain cached creds
+vol.py -f mem.raw --profile=PROFILE mimikatz      # (plugin) plaintext creds
+
+# Vol3
+vol -f mem.raw windows.hashdump
+vol -f mem.raw windows.lsadump
+vol -f mem.raw windows.cachedump
+```
+
+### Step 7: File Extraction
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE filescan | grep -i "password\|secret\|flag"
+vol.py -f mem.raw --profile=PROFILE dumpfiles -Q OFFSET -D /tmp/dump/
+
+# Vol3
+vol -f mem.raw windows.filescan
+vol -f mem.raw windows.dumpfiles --virtaddr OFFSET
+```
+
+### Step 8: Registry Analysis
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE hivelist
+vol.py -f mem.raw --profile=PROFILE printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"
+vol.py -f mem.raw --profile=PROFILE userassist    # program execution evidence
+
+# Vol3
+vol -f mem.raw windows.registry.hivelist
+vol -f mem.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"
+```
+
+### Step 9: Command History
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE cmdscan       # cmd.exe history
+vol.py -f mem.raw --profile=PROFILE consoles       # full console output
+
+# Vol3
+vol -f mem.raw windows.cmdline
+```
+
+### Step 10: Timeline Generation
+
+```bash
+# Vol2
+vol.py -f mem.raw --profile=PROFILE timeliner --output=body --output-file=timeline.body
+mactime -b timeline.body -d > timeline.csv
+
+# Vol3
+vol -f mem.raw timeliner.Timeliner
+```
+
+---
+
+## 4. LINUX MEMORY ANALYSIS
+
+```bash
+# Vol2 (requires Linux profile)
+vol.py -f mem.lime --profile=LinuxProfile linux_pslist
+vol.py -f mem.lime --profile=LinuxProfile linux_pstree
+vol.py -f mem.lime --profile=LinuxProfile linux_netstat
+vol.py -f mem.lime --profile=LinuxProfile linux_bash        # bash history
+vol.py -f mem.lime --profile=LinuxProfile linux_enumerate_files
+vol.py -f mem.lime --profile=LinuxProfile linux_proc_maps -p PID
+vol.py -f mem.lime --profile=LinuxProfile linux_malfind
+
+# Vol3
+vol -f mem.lime linux.pslist
+vol -f mem.lime linux.pstree
+vol -f mem.lime linux.bash
+vol -f mem.lime linux.check_afinfo     # rootkit detection
+vol -f mem.lime linux.check_syscall    # syscall hooking
+vol -f mem.lime linux.tty_check        # TTY hooking
+```
+
+### Building Linux Profiles (Vol2)
+
+```bash
+cd volatility/tools/linux
+make
+# Creates module.dwarf + System.map → zip as profile
+zip LinuxProfile.zip module.dwarf /boot/System.map-$(uname -r)
+# Place in volatility/plugins/overlays/linux/
+```
+
+---
+
+## 5. MALWARE INDICATORS IN MEMORY
+
+| Indicator | Detection Method | What It Means |
+|---|---|---|
+| Process in psscan but not pslist | Compare pslist vs psscan | DKOM — process hiding |
+| Unexpected parent-child | pstree analysis | e.g., svchost spawned by cmd.exe |
+| MZ header in non-image memory | malfind | Reflective DLL / PE injection |
+| RWX memory without backing file | malfind | Shellcode injection |
+| DLL unlinked from all PEB lists | ldrmodules (all False) | Stealth DLL loading |
+| svchost.exe not child of services.exe | pstree | Fake svchost (malware) |
+| Unusual network connections | netscan + PID correlation | C2 communication |
+| Hooking in SSDT/IDT | ssdt / idt plugins | Rootkit |
+| Modified kernel objects | linux_check_syscall | Linux rootkit |
+
+### Normal Parent-Child Relationships (Windows)
+
+```
+System (4)
+└── smss.exe
+    └── csrss.exe
+    └── wininit.exe
+        └── services.exe
+            └── svchost.exe (multiple)
+            └── spoolsv.exe
+        └── lsass.exe
+    └── winlogon.exe
+        └── explorer.exe
+            └── user applications
+```
+
+---
+
+## 6. DECISION TREE
+
+```
+Memory dump acquired — need to analyze
+│
+├── What OS?
+│   ├── Windows → vol imageinfo / windows.info (§3 Step 1)
+│   └── Linux → build profile or use Vol3 auto-detect (§4)
+│
+├── Malware investigation?
+│   ├── Check processes: pslist vs psscan (hidden?) (§3 Step 2)
+│   ├── Check parent-child: pstree (suspicious spawning?) (§5)
+│   ├── Check injections: malfind (RWX memory?) (§3 Step 5)
+│   ├── Check DLLs: ldrmodules (unlinked?) (§3 Step 4)
+│   ├── Check network: netscan (C2 connections?) (§3 Step 3)
+│   └── Extract suspicious files: dumpfiles (§3 Step 7)
+│
+├── Credential recovery?
+│   ├── SAM hashes → hashdump (§3 Step 6)
+│   ├── LSA secrets → lsadump (§3 Step 6)
+│   ├── Cached domain creds → cachedump (§3 Step 6)
+│   └── Plaintext passwords → mimikatz plugin (§3 Step 6)
+│
+├── Incident timeline?
+│   ├── timeliner for comprehensive timeline (§3 Step 10)
+│   ├── cmdscan / consoles for command history (§3 Step 9)
+│   ├── userassist for program execution (§3 Step 8)
+│   └── Cross-reference with PCAP timeline (→ traffic-analysis-pcap)
+│
+├── CTF / flag hunting?
+│   ├── filescan + grep for flag patterns (§3 Step 7)
+│   ├── cmdscan for typed flags/passwords (§3 Step 9)
+│   ├── Clipboard: clipboard plugin
+│   ├── Screenshots: screenshot plugin
+│   └── Environment vars: envars plugin
+│
+└── Linux-specific?
+    ├── linux_bash for shell history (§4)
+    ├── linux_check_syscall for rootkit (§4)
+    └── linux_netstat for connections (§4)
+```

package/skills/memory-forensics-volatility/VOLATILITY_CHEATSHEET.md

@@ -0,0 +1,225 @@
+---
+name: volatility-cheatsheet
+description: >-
+  Volatility 2 and 3 command comparison table with common plugin sequences for specific investigation types.
+---
+
+# VOLATILITY CHEATSHEET — Vol2 / Vol3 Command Reference
+
+> Supplementary reference for [memory-forensics-volatility](./SKILL.md). Quick-access command tables.
+
+---
+
+## 1. COMMAND COMPARISON TABLE
+
+### System Information
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| OS identification | `imageinfo` | `windows.info` |
+| Kernel debug scan | `kdbgscan` | (auto) |
+| OS banners | `imageinfo` | `banners.Banners` |
+
+### Process Analysis
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| Process list (linked) | `pslist` | `windows.pslist` |
+| Process list (scan) | `psscan` | `windows.psscan` |
+| Process tree | `pstree` | `windows.pstree` |
+| Process command line | `cmdline` | `windows.cmdline` |
+| Process environment | `envars` | `windows.envars` |
+| Process handles | `handles` | `windows.handles` |
+| Process privileges | `privs` | `windows.privileges` |
+| Process SIDs | `getsids` | `windows.getsids` |
+
+### Memory / DLL
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| Loaded DLLs | `dlllist` | `windows.dlllist` |
+| Unlinked DLL detection | `ldrmodules` | `windows.ldrmodules` |
+| Code injection | `malfind` | `windows.malfind` |
+| VAD tree | `vadinfo` | `windows.vadinfo` |
+| Dump process memory | `memdump -p PID` | `windows.memmap --dump --pid PID` |
+| Dump DLLs | `dlldump -p PID` | `windows.dlllist --pid PID --dump` |
+
+### Network
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| All connections (Vista+) | `netscan` | `windows.netscan` |
+| Active connections (XP) | `connections` | N/A |
+| Listening sockets (XP) | `sockets` | N/A |
+| Connection scan (XP) | `connscan` | N/A |
+| Net stats | N/A | `windows.netstat` |
+
+### Credentials
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| SAM hashes | `hashdump` | `windows.hashdump` |
+| LSA secrets | `lsadump` | `windows.lsadump` |
+| Cached creds | `cachedump` | `windows.cachedump` |
+| Mimikatz | `mimikatz` (plugin) | N/A (use hashdump/lsadump) |
+
+### File System
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| File scan | `filescan` | `windows.filescan` |
+| File dump | `dumpfiles -Q OFFSET` | `windows.dumpfiles --virtaddr ADDR` |
+| MFT analysis | `mftparser` | `windows.mftscan` |
+
+### Registry
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| List hives | `hivelist` | `windows.registry.hivelist` |
+| Print key | `printkey -K "path"` | `windows.registry.printkey --key "path"` |
+| User assist | `userassist` | `windows.registry.userassist` |
+| Shimcache | `shimcache` | N/A (third-party) |
+
+### History / User Activity
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| CMD history | `cmdscan` | `windows.cmdline` |
+| Console output | `consoles` | `windows.consoles` |
+| Clipboard | `clipboard` | `windows.clipboard` |
+| Screenshots | `screenshot` | N/A |
+| IE history | `iehistory` | N/A |
+
+### Rootkit / Hooking
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| SSDT hooks | `ssdt` | `windows.ssdt` |
+| IDT hooks | `idt` | N/A |
+| Driver scan | `driverscan` | `windows.driverscan` |
+| Kernel modules | `modules` | `windows.modules` |
+| Moddump | `modscan` | `windows.modscan` |
+| Callbacks | `callbacks` | `windows.callbacks` |
+
+### Timeline
+
+| Purpose | Volatility 2 | Volatility 3 |
+|---|---|---|
+| Generate timeline | `timeliner` | `timeliner.Timeliner` |
+
+---
+
+## 2. COMMON INVESTIGATION SEQUENCES
+
+### Malware Triage (Quick)
+
+```bash
+# Vol3
+vol -f mem.raw windows.info
+vol -f mem.raw windows.pstree
+vol -f mem.raw windows.malfind
+vol -f mem.raw windows.netscan
+```
+
+### Full Malware Investigation
+
+```bash
+# Vol3
+vol -f mem.raw windows.info
+vol -f mem.raw windows.pslist
+vol -f mem.raw windows.psscan         # compare with pslist
+vol -f mem.raw windows.pstree         # check parent-child
+vol -f mem.raw windows.cmdline        # command lines
+vol -f mem.raw windows.netscan        # C2 connections
+vol -f mem.raw windows.malfind        # code injection
+vol -f mem.raw windows.dlllist --pid SUSPICIOUS_PID
+vol -f mem.raw windows.handles --pid SUSPICIOUS_PID
+vol -f mem.raw windows.filescan | grep -i "suspicious_name"
+vol -f mem.raw windows.dumpfiles --virtaddr OFFSET
+```
+
+### Credential Extraction
+
+```bash
+# Vol3
+vol -f mem.raw windows.hashdump
+vol -f mem.raw windows.lsadump
+vol -f mem.raw windows.cachedump
+```
+
+### Incident Response Timeline
+
+```bash
+# Vol3
+vol -f mem.raw windows.info
+vol -f mem.raw timeliner.Timeliner
+vol -f mem.raw windows.cmdline
+vol -f mem.raw windows.registry.userassist
+vol -f mem.raw windows.netscan
+vol -f mem.raw windows.filescan
+```
+
+### CTF Challenge
+
+```bash
+# Vol3
+vol -f mem.raw windows.info           # or banners.Banners
+vol -f mem.raw windows.filescan | grep -iE "flag|secret|password|key"
+vol -f mem.raw windows.cmdline        # look for typed commands
+vol -f mem.raw windows.pslist         # find interesting processes
+vol -f mem.raw windows.netscan        # find interesting connections
+vol -f mem.raw windows.dumpfiles --virtaddr OFFSET  # extract files
+vol -f mem.raw windows.hashdump       # extract hashes
+```
+
+### Linux Rootkit Detection
+
+```bash
+# Vol3
+vol -f mem.lime linux.pslist
+vol -f mem.lime linux.check_syscall
+vol -f mem.lime linux.check_afinfo
+vol -f mem.lime linux.tty_check
+vol -f mem.lime linux.bash
+vol -f mem.lime linux.elfs            # find injected ELFs
+```
+
+---
+
+## 3. PROFILE MANAGEMENT (Vol2)
+
+```bash
+# List available profiles
+vol.py --info | grep -i "Profile"
+
+# Common Windows profiles
+Win7SP1x64, Win10x64_19041, Win10x64_17763, WinXPSP3x86, Win2016x64_14393
+
+# Determine correct profile
+vol.py -f mem.raw imageinfo
+# Use "Suggested Profile(s)" from output
+
+# Custom Linux profile
+# On target system:
+cd volatility/tools/linux && make
+zip profile.zip module.dwarf /boot/System.map-$(uname -r)
+cp profile.zip volatility/plugins/overlays/linux/
+```
+
+---
+
+## 4. USEFUL GREP PATTERNS
+
+```bash
+# Find interesting files
+vol -f mem.raw windows.filescan | grep -iE '\.(txt|doc|xls|pdf|kdbx|key|pem|conf|ini|bat|ps1)$'
+
+# Find web-related files
+vol -f mem.raw windows.filescan | grep -iE '\.(php|asp|jsp|html)$'
+
+# Find executables in unusual locations
+vol -f mem.raw windows.filescan | grep -iE '\\(temp|tmp|appdata|downloads)\\.*\.exe'
+
+# Network connections to external IPs
+vol -f mem.raw windows.netscan | grep -v "127.0.0.1\|0.0.0.0\|::1\|::"
+```