by mukul975
detecting-rootkit-activity is a Malware Analysis skill for finding rootkit indicators such as hidden processes, hooked system calls, altered kernel structures, hidden modules, and covert network artifacts. It uses cross-view comparison and integrity checks to help validate suspicious hosts when standard tools disagree.
by mukul975
extracting-memory-artifacts-with-rekall guide for analyzing Windows memory images with Rekall. Learn install and usage patterns to find hidden processes, injected code, suspicious VADs, loaded DLLs, and network activity for Digital Forensics.
by mukul975
The extracting-credentials-from-memory-dump skill helps analyze Windows memory dumps for NTLM hashes, LSA secrets, Kerberos material, and tokens using Volatility 3 and pypykatz workflows. It is built for Digital Forensics and incident response when you need defensible evidence, account impact, and remediation guidance from a valid dump.
by mukul975
detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.
by mukul975
analyzing-memory-dumps-with-volatility is a Volatility 3 skill for memory forensics, malware triage, hidden processes, injection, network activity, and credentials in RAM dumps on Windows, Linux, or macOS. Use it when you need a repeatable analyzing-memory-dumps-with-volatility guide for incident response and malware analysis.
by mukul975
analyzing-linux-kernel-rootkits helps DFIR and threat-hunting workflows detect Linux kernel rootkits with Volatility3 cross-view checks, rkhunter scans, and /proc vs /sys analysis for hidden modules, hooked syscalls, and tampered kernel structures. It is a practical analyzing-linux-kernel-rootkits guide for forensic triage.
by mukul975
The detecting-fileless-malware-techniques skill supports Malware Analysis workflows for investigating fileless malware that runs in memory through PowerShell, WMI, .NET reflection, registry-resident payloads, and LOLBins. Use it to move from suspicious alerts to evidence-backed triage, detection ideas, and next-step hunting.
by mukul975
conducting-memory-forensics-with-volatility helps you analyze RAM dumps with Volatility 3 to find injected code, suspicious processes, network connections, credential theft, and hidden kernel activity. It is a practical conducting-memory-forensics-with-volatility skill for Digital Forensics and incident response triage.
by mukul975
analyzing-heap-spray-exploitation helps analyze heap spray exploitation in memory dumps with Volatility3. It identifies NOP sled patterns, suspicious large allocations, shellcode landing zones, and process VAD evidence for Security Audit, malware triage, and exploit validation.
