Please enable JavaScript.
Coggle requires JavaScript to display documents.
Volatility - Coggle Diagram
Volatility
Process Object
handles
Mutant (Threat Intel)
getsids (Security ID)
cmdline
dllist
Setup
Profile
VOLATILITY_PROFILE
Location
VOLATILITY_LOCATION
Image
imageinfo
kdbgscan
Hibernation
imagecopy
Code Injection
DLL Injection
Allocate
VirualAllocEx()
WriteProcessMemory()
Execute
CreateRemoteThread()
LoadLibraryA()
Attach
OpenProcess()
Plugin
ldrmodules
False/ MappedPath
InInit
InMem
InLoad
Reflective Code Injection
malfind
Plugin
ldrmodules
malfind
hollowfind
threadmap
Rootking & Hooking
Types
IDT
idt
IAT & Inline API
apihooks
SSDT
ssdt
Eliminate ntoskrnl.exe | win32k.sys
IRP
DKOM
psxview
Plugins
ssdt
psxview (cross-view)
modscan (scan loaded,unlinked, unloaded kernel) & modules (identify kernel drivers loaded)
apihooks (IAT)
driverirp
idt
Rouge Process
EPROCESS
pstree
malprocfind (scan anomalies)
psscan (scan EPROCESS)
baseline (Compare with clean image)
processbl
pslist (1st steps)
Network Artifacts
netscan
Extract & Dump
Process Object
consoles
cmdscan
dlldump
Driver
moddump
Processes
Procdump
memdump
strings
grep
Files
dumpfiles
filescan
Registry
shimcachemem