DFIR^:DFIR

Volatility 3

Volatility 3 Windows memory forensics: processes, network, injection, hashes and plugin workflow.

advancedupdated 2026-08-09Volatility 3
#dfir#memory-forensics#malware

Volatility 3

Windows memory forensics cheat sheet.

Basic Command Structure

# Standard syntax
vol -f <memory.raw> <plugin>

# With options
vol -f memory.raw -o output/ -r json windows.pslist

# Plugin-specific help
vol windows.pslist -h

Key Differences from Volatility 2

  • NO --profile needed (auto-detection)
  • Plugin namespace: windows.plugin_name
  • Faster execution
  • Python 3.8+ required
  • Unified output formats

Complete Plugin Enumeration Workflow

Phase 1: System Identification

# Verify image and get OS info
vol -f memory.raw windows.info

# Output: OS version, architecture, kernel base, system time

Phase 2: Process Analysis

Process Enumeration (Multiple Methods)

# Active processes (linked list traversal)
vol -f memory.raw windows.pslist

# Hidden/terminated processes (pool scanning)
vol -f memory.raw windows.psscan

# Process hierarchy tree
vol -f memory.raw windows.pstree

# Cross-reference detection (rootkit hunting)
vol -f memory.raw windows.psxview

Process Details

# Command-line arguments
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.cmdline --pid 1234

# Command history from cmd.exe
vol -f memory.raw windows.cmdscan

# Console buffers
vol -f memory.raw windows.consoles

# Environment variables
vol -f memory.raw windows.envars --pid 1234

# Process privileges
vol -f memory.raw windows.privileges.Privs

# Process SIDs
vol -f memory.raw windows.getsids

# Process threads
vol -f memory.raw windows.threads
vol -f memory.raw windows.threads --pid 1234

# Suspended threads
vol -f memory.raw windows.suspended_threads

# Suspicious threads
vol -f memory.raw windows.suspicious_threads

# Debug registers
vol -f memory.raw windows.debugregisters

# Orphaned kernel threads
vol -f memory.raw windows.orphan_kernel_threads

DLL Analysis

# Loaded DLLs per process
vol -f memory.raw windows.dlllist
vol -f memory.raw windows.dlllist --pid 1234

# DLL load verification (detect DLL injection)
vol -f memory.raw windows.ldrmodules

# Unloaded modules
vol -f memory.raw windows.unloadedmodules

Handles

# Open handles (files, registry, mutexes, etc.)
vol -f memory.raw windows.handles
vol -f memory.raw windows.handles --pid 1234

Phase 3: Network Analysis

# Network connections (TCP/UDP) - Vista+
vol -f memory.raw windows.netscan

# Alternative: netstat (Vista+)
vol -f memory.raw windows.netstat

Output: Local/Remote addresses, PIDs, state, protocol, timestamps.

Phase 4: File System Analysis

# Scan for FILE_OBJECT structures
vol -f memory.raw windows.filescan

# Dump cached files
vol -f memory.raw -o output/ windows.dumpfiles
vol -f memory.raw -o output/ windows.dumpfiles --pid 1234
vol -f memory.raw -o output/ windows.dumpfiles --virtaddr 0x12345678
vol -f memory.raw -o output/ windows.dumpfiles --physaddr 0xabcdef

# MFT entries scanning
vol -f memory.raw windows.mftscan.MFTScan

# Alternate Data Streams (ADS)
vol -f memory.raw windows.mftscan.ADS

# Symbolic links
vol -f memory.raw windows.symlinkscan

Phase 5: Registry Analysis

# List registry hives
vol -f memory.raw windows.registry.hivelist

# Scan for hives
vol -f memory.raw windows.registry.hivescan

# Print registry keys
vol -f memory.raw windows.registry.printkey
vol -f memory.raw windows.registry.printkey --key "Software\\Microsoft\\Windows\\CurrentVersion\\Run"

# UserAssist (tracks executed programs)
vol -f memory.raw windows.registry.userassist

# Certificates
vol -f memory.raw windows.registry.certificates.Certificates

# Hooked registry handlers
vol -f memory.raw windows.registry.getcellroutine

Phase 6: Malware Detection

Code Injection Detection

# Find injected code
vol -f memory.raw windows.malfind

# Hollow processes
vol -f memory.raw windows.hollowprocesses

# Process ghosting
vol -f memory.raw windows.processghosting

# Direct system calls (EDR bypass)
vol -f memory.raw windows.direct_system_calls

# Indirect system calls (EDR bypass)
vol -f memory.raw windows.indirect_system_calls

# Unhooked system calls (EDR bypass)
vol -f memory.raw windows.unhooked_system_calls

Kernel Hooks & Rootkits

# Kernel callbacks
vol -f memory.raw windows.callbacks.Callbacks

# SSDT (System Service Descriptor Table)
vol -f memory.raw windows.ssdt.SSDT

# Driver IRP hooks
vol -f memory.raw windows.driverirp.DriverIrp

# Hidden drivers
vol -f memory.raw windows.drivermodule.DriverModule

# Skeleton Key malware detection
vol -f memory.raw windows.skeleton_key_check.Skeleton_Key_Check

# Kernel timers
vol -f memory.raw windows.timers.Timers

YARA Scanning

# Scan process memory with YARA
vol -f memory.raw windows.vadyarascan --yara-file rules.yar
vol -f memory.raw windows.vadyarascan --yara-rules "rule test { strings: $a = \"malware\" condition: $a }"

# Scan entire memory
vol -f memory.raw yarascan.YaraScan --yara-file rules.yar

# Regex scanning
vol -f memory.raw windows.vadregexscan --pattern "https?://[a-zA-Z0-9]+"

Import Address Table (IAT) Analysis

vol -f memory.raw windows.iat.IAT --pid 1234

Phase 7: Memory Dumps

# Dump process memory
vol -f memory.raw -o output/ windows.memmap --dump --pid 1234

# Dump PE executables
vol -f memory.raw -o output/ windows.pedump.PEDump --pid 1234

# Memory map
vol -f memory.raw windows.memmap --pid 1234

# VAD (Virtual Address Descriptor) information
vol -f memory.raw windows.vadinfo --pid 1234

# Walk VAD tree
vol -f memory.raw windows.vadwalk --pid 1234

Phase 8: Windows Services

# List services (doubly-linked list)
vol -f memory.raw windows.svclist.SvcList

# Scan for services (pool scanning)
vol -f memory.raw windows.svcscan.SvcScan

# Compare methods (rootkit detection)
vol -f memory.raw windows.svcdiff.SvcDiff

# Service SIDs
vol -f memory.raw windows.getservicesids.GetServiceSIDs

Phase 9: Scheduled Tasks

vol -f memory.raw windows.scheduled_tasks.ScheduledTasks

Phase 10: Credential Extraction

# Password hashes
vol -f memory.raw windows.hashdump.Hashdump

# LSA secrets
vol -f memory.raw windows.lsadump.Lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump.Cachedump

# TrueCrypt passphrases
vol -f memory.raw windows.truecrypt.Passphrase

Phase 11: Driver Analysis

# Loaded kernel modules
vol -f memory.raw windows.modules.Modules

# Scan for drivers (finds hidden)
vol -f memory.raw windows.driverscan.DriverScan

# Module scanning
vol -f memory.raw windows.modscan.ModScan

# Device tree
vol -f memory.raw windows.devicetree.DeviceTree

# KPCR structures
vol -f memory.raw windows.kpcrs.KPCRs

Phase 12: Forensic Artifacts

# AmCache
vol -f memory.raw windows.amcache.Amcache

# ShimCache
vol -f memory.raw windows.shimcachemem.ShimcacheMem

# Big page pools
vol -f memory.raw windows.bigpools.BigPools

# Master Boot Record scanning
vol -f memory.raw windows.mbrscan.MBRScan

# Job links
vol -f memory.raw windows.joblinks.JobLinks

# Sessions
vol -f memory.raw windows.sessions.Sessions

# Crash dump info
vol -f memory.raw windows.crashinfo.Crashinfo

# PE symbols
vol -f memory.raw windows.pe_symbols.PESymbols

# Version info
vol -f memory.raw windows.verinfo.VerInfo

# Statistics
vol -f memory.raw windows.statistics.Statistics

Phase 13: Mutexes & Synchronization

# Scan for mutexes
vol -f memory.raw windows.mutantscan.MutantScan

Phase 14: Timeline Analysis

# Generate timeline from all plugins
vol -f memory.raw timeliner.Timeliner

New Plugins in Volatility 3 (v2.7–2.26)

EDR Bypass Detection

windows.direct_system_calls       # Direct syscall technique
windows.indirect_system_calls     # Indirect syscall technique
windows.unhooked_system_calls     # Unhooked syscall detection

Advanced Malware Detection

windows.hollowprocesses           # Process hollowing detection
windows.processghosting           # Process ghosting technique
windows.suspended_threads         # Find suspended threads
windows.suspicious_threads        # Identify suspicious threads
windows.orphan_kernel_threads     # Orphaned kernel threads

Command History & Console

windows.cmdscan                   # Command history scanning
windows.consoles                  # Console buffer extraction

Registry & Forensics

windows.amcache.Amcache           # AmCache parsing
windows.scheduled_tasks           # Scheduled tasks
windows.registry.getcellroutine   # Registry hook detection
windows.shimcachemem              # ShimCache from memory
windows.debugregisters            # Hardware breakpoint detection

Import Address Table

windows.iat.IAT                   # IAT extraction and analysis

Process Cross-Reference

windows.psxview                   # Multi-method process detection

Regex & Advanced Scanning

windows.vadregexscan              # Regex pattern scanning in VADs

Output Formats

# JSON output
vol -f memory.raw -r json windows.pslist > output.json

# CSV output
vol -f memory.raw -r csv windows.pslist > output.csv

# Pretty formatted
vol -f memory.raw -r pretty windows.pslist

# JSONL (line-delimited JSON)
vol -f memory.raw -r jsonl windows.netscan

# Save to file
vol -f memory.raw windows.pslist > pslist.txt

Advanced Tips & Tricks

1. Filtering & Targeting

# Target specific PID
vol -f memory.raw windows.pslist --pid 1234
vol -f memory.raw windows.dlllist --pid 1234

# Multiple PIDs (plugin dependent)
vol -f memory.raw windows.handles --pid 1234 --pid 5678

2. Parallel Processing

vol -f memory.raw --parallelism processes windows.psscan

3. Verbosity for Debugging

# Increase verbosity to troubleshoot
vol -f memory.raw -vvv windows.info

4. Offline Mode

# Disable online symbol lookups
vol -f memory.raw --offline windows.pslist

5. Configuration Files

# Use config file for repeated analysis
vol -c config.json windows.pslist

# Save configuration
vol -f memory.raw --save-config analysis.json windows.pslist

6. Combining Outputs

# Run multiple plugins and save all
for plugin in pslist pstree netscan filescan; do
    vol -f memory.raw windows.$plugin > ${plugin}_output.txt
done

7. Hunting for Specific Artifacts

# Find specific string in process memory
vol -f memory.raw windows.strings | grep -i "password"

# Search for IP addresses
vol -f memory.raw windows.netscan | grep "192.168"

# Find processes without parent
vol -f memory.raw windows.pstree | grep "PPID: 0"

8. Memory Dump Extraction

# Dump specific process
vol -f memory.raw -o dumps/ windows.memmap --dump --pid 1234

# Dump all files
vol -f memory.raw -o files/ windows.dumpfiles

# Dump executable only
vol -f memory.raw -o exe/ windows.pedump --pid 1234

Malware Analysis Workflow

Step 1: Initial Triage

vol -f memory.raw windows.info
vol -f memory.raw windows.pslist
vol -f memory.raw windows.pstree
vol -f memory.raw windows.netscan

Step 2: Identify Suspicious Processes

Look for:

  • Processes with no parent (PPID: 0)
  • Misspelled system processes
  • Unusual paths (not in System32/Program Files)
  • Processes with network connections
  • Short-lived processes (in psscan but not pslist)

Step 3: Deep Dive on Suspicious Process

PID=<suspicious_pid>
vol -f memory.raw windows.cmdline --pid $PID
vol -f memory.raw windows.dlllist --pid $PID
vol -f memory.raw windows.handles --pid $PID
vol -f memory.raw windows.envars --pid $PID
vol -f memory.raw windows.malfind --pid $PID
vol -f memory.raw windows.vadinfo --pid $PID

Step 4: Code Injection Detection

vol -f memory.raw windows.malfind
vol -f memory.raw windows.hollowprocesses
vol -f memory.raw windows.ldrmodules
vol -f memory.raw windows.direct_system_calls
vol -f memory.raw windows.indirect_system_calls

Step 5: Persistence Mechanisms

vol -f memory.raw windows.registry.printkey --key "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
vol -f memory.raw windows.registry.userassist
vol -f memory.raw windows.scheduled_tasks
vol -f memory.raw windows.svcscan

Step 6: Dump & Analyze

vol -f memory.raw -o output/ windows.memmap --dump --pid $PID
vol -f memory.raw -o output/ windows.pedump --pid $PID

Rootkit Detection Checklist

# 1. Hidden processes
vol -f memory.raw windows.psxview

# 2. Hidden drivers
vol -f memory.raw windows.drivermodule

# 3. Kernel hooks
vol -f memory.raw windows.ssdt
vol -f memory.raw windows.callbacks
On this page

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.