Главная
Study mode:
on
1
Intro
2
You are Freaking Awesome!
3
Memory Forensics IRL
4
Evidence in Memory
5
Rekall Memory Forensic Framework
6
Investigative Methodology: Use Case: Identifying Malware
7
Interactive Rekall Session
8
Profile Auto-detection
9
Session Caching
10
Process Enumeration pslist Using Volatility
11
Process Enumeration with Rekall Choose Your Poison Rekall's PSList Methods of Enumeration
12
Process Scanning with Rekall Output Options
13
Advantages of Baselining: "Know Normal, Find Evil."
14
MBR Persistence
15
Memory Analysis with Rekall Step 1: Identify Roque Processes
16
Know Normal (Windows Processes), Find Evil
17
Step 3: Network Connections
18
Signs of Code Injection
19
Detect Rootkit Behaviors
20
Memory Analysis with Rekall Step 6: Acquisition of Notable Findings
21
AFF4 Volume Format
22
Live Analysis with Rekall (1)
23
Live Analysis with Rekall (3) Acquisition
24
References
Description:
Explore memory forensics techniques and the Rekall Memory Forensic Framework in this 53-minute conference talk from BSides Augusta 2015. Learn about evidence in memory, investigative methodology for identifying malware, and interactive Rekall sessions. Discover process enumeration methods, advantages of baselining, and how to detect rootkit behaviors. Gain insights into live analysis techniques and the AFF4 volume format. Enhance your skills in digital forensics and malware detection through practical demonstrations and real-world use cases.

Building a Muscle Memory with Rekall Memory Forensic Framework

Add to list