Главная
Study mode:
on
1
Intro
2
Documentation
3
Volatility Framework
4
Purpose
5
Methodology
6
Sampling
7
Profile Library
8
Baselines (continued)
9
Caveat: Hook comparisons
10
Hook comparisons (continued)
11
Whitelisting/Blacklisting
12
Indicators of Compromise (IOCs)
13
Cyboxer Plugin Example
14
Set Difference
15
Union
16
Intersection
17
Symmetric Difference
18
Multiple Profiles
19
Profiler Plugin (continued)
20
Symantecprofiler Plugin
21
Profiler Plugin Discussion
22
CybOX (IOC) generation
23
Stalker Plugin
24
Hunter Plugin
25
Jack Crook DFIR Challenge
26
Processes
27
Executables
28
Conclusion
29
Questions?
Description:
Explore advanced techniques in memory forensics through this 29-minute conference talk from the CSAW'16 Security Open Source Workshop at New York University. Delve into the Volatility Framework, understanding its purpose and methodology. Learn about sampling, profile libraries, and baselines, with a focus on hook comparisons. Discover the importance of whitelisting/blacklisting and Indicators of Compromise (IOCs). Examine practical applications through plugins like Cyboxer, Profiler, and Stalker. Investigate multiple profiles, set operations, and CybOX generation. Analyze processes and executables using the Hunter plugin. Conclude with insights from the Jack Crook DFIR Challenge, enhancing your skills in digital forensics and incident response.

Taking Memory Forensics to the Next Level

New York University (NYU)
Add to list
0:00 / 0:00