Chapter 11. Detecting Advanced Malware Using Memory Forensics

In the previous chapter, we looked at different Volatility plugins, which help in extracting valuable information from the memory image. In this chapter, we will continue our journey of memory forensics and we will look at a few more plugins that will help you extract forensic artifacts from the memory image infected with advanced malware, which uses stealth and concealment techniques. In the next section, we will focus on detecting code injection techniques using memory forensics. The next section discusses some of the concepts already covered in Chapter 8, Code Injection and Hooking, so it is highly recommended to read that chapter before reading the next section.