CCNA Introduction to Memory Forensics Questions

Reconstructing command-line arguments is essential for understanding the specific intent of a malicious executable. The Process Environment Block (PEB) contains the command line string passed to a process at the time of its creation. By extracting this structure from memory, an analyst can reveal hidden parameters, remote IP addresses, or command flags that the malware author attempted to hide from the visual process list, providing critical context for the investigation.

The Object Header precedes the body of every object managed by the Windows kernel, such as processes, threads, or files. It contains critical metadata, including the object type, reference count, and security descriptor. For forensic analysts, this header provides vital information about the object's lifespan and permissions, which is crucial for identifying unauthorized access or tracking the lifecycle of malicious objects within the kernel's memory management system.

To detect a driver that has been unlinked from the active module list, you need plugins that scan kernel pool memory for driver-related structures. windows.modscan finds module structures, and windows.driverscan finds driver objects. Together they can reveal a hidden driver that a rootkit has unlinked. The other plugins either list only active modules, focus on IRP hooking, or enumerate callbacks, none of which directly detect unlinked drivers.

In Volatility 3, the windows.netscan plugin is designed to scan memory for network connection structures, providing details such as local and remote addresses, ports, and owning process IDs. It works by pool tag scanning, which can uncover connections even if they are not in the active list. The other options are either Volatility 2 plugins or non-existent, making windows.netscan the correct choice.

Kernel data structures, such as the EPROCESS list or the KPCR, change in offset and size between different OS builds and service packs. If an incorrect profile is used, the analysis tool will misinterpret these structures, leading to incorrect process listing, failed memory mapping, or complete analysis failure. Using the correct profile ensures that the tool accurately maps the memory layout according to the specific kernel offsets of the target system.

The page file is a disk-based extension of physical RAM. When a system performs a dump, it may contain data swapped from physical memory to the page file. Forensic analysts must understand this because critical evidence—such as decrypted payloads or old process data—might exist in the page file rather than the active physical RAM, requiring the analyst to reconstruct the virtual address space using both sources.

A driver unlinked from PsLoadedModuleList will not appear in the modules plugin output, but its DRIVER_OBJECT may still reside in pool memory. The driverscan plugin locates these objects by scanning pool memory, making it the appropriate cross-check for detecting hidden or unlinked kernel drivers in the image.

Discrepancies between the PEB and the Virtual Address Descriptor (VAD) tree often indicate process hollowing or replacement. Malware frequently updates the PEB image path to masquerade as legitimate system services while the VAD tree reflects the actual memory mapping of the injected code. Identifying this mismatch is critical for uncovering stealthy code injection techniques that bypass simple process listing tools by hiding the true origin of the executable.

The windows.netscan plugin in Volatility 3 is specifically designed to scan memory for network connection structures and correlate them with owning processes. It provides a comprehensive view of active TCP and UDP endpoints, including local and remote addresses, ports, and process IDs. Other plugin names listed are either non-existent or less reliable, making windows.netscan the correct choice for this task.

Pool tags and residual pool allocations can persist after a driver unloads, so searching for a driver's known pool tags and comparing against the current module list can reveal that it was loaded earlier. The module list itself only shows current modules, registry keys show configuration, and event logs are not reliable for this purpose in memory forensics.

Process hollowing unmaps or overwrites the original image and injects replacement code, so the primary image region loses its legitimate file backing and threads often start in unbacked memory. Observing both an unbacked primary image and a thread starting outside known modules forms a coherent, high-confidence pattern. Pipe handles, token privilege changes, and working set size are unrelated to the hollowing technique.

The KPCR is a structure containing critical processor-specific information, including the current thread and CPU state. It is vital for forensic analysts because it serves as the anchor for finding the current thread of execution on each core. Understanding the KPCR helps analysts reconstruct the execution context, which is essential for identifying which threads were running at the moment of capture, especially during complex multi-threaded attacks.

windows.psscan uses pool tag scanning to locate EPROCESS structures in memory, which can uncover processes that have been unlinked from the active process list by rootkits or other hiding techniques. By comparing its output with windows.pslist, an analyst can identify discrepancies indicating hidden processes. The other plugins either rely on the active list or serve different purposes, such as command-line retrieval or network connection enumeration.

To detect hidden processes, analysts compare the output of windows.pslist, which walks the active process list, with windows.psscan, which scans physical memory for process objects using pool tag scanning. Discrepancies where psscan finds processes not in pslist indicate hidden processes, often due to rootkit activity. The other plugins do not provide this comparison and are used for different forensic purposes.

Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

The VAD tree is a kernel structure used by the memory manager to keep track of the virtual memory ranges allocated to a process. It is essential for forensic analysts because it defines the memory map of a process, including which areas are executable, read-only, or writable. This structure is critical for identifying memory-resident threats that attempt to hide their presence by manipulating memory permissions to execute malicious code.

SSDT hooking involves redirecting system service calls by modifying the SSDT, which normally points to functions within ntoskrnl.exe. Two key indicators are SSDT entries pointing outside ntoskrnl.exe and the SSDT being writable when it should be read-only. Other artifacts like missing driver files or IDT variations are not specific to SSDT hooking, and a modified kernel hash indicates patching rather than hooking.

windows.netscan can surface network structures that outlive their owning process, so missing process entries alongside established connections often reflect terminated processes rather than hidden malware. Correlating process IDs, timestamps, and other artifacts is the proper next step. Claiming rootkit activity, image corruption, or a confirmed attack from this observation alone is premature and unsupported.

The windows.modules plugin is designed to enumerate loaded kernel modules from a Windows memory image, providing a list of drivers and their base addresses. This is essential for comparing against a known-good baseline to identify unauthorized or malicious kernel modules. The other plugins target process lists, DLLs within processes, or handles, none of which directly provide a system-wide kernel module enumeration.

To identify the operating system version and service pack from a memory image, you need a plugin that reads kernel version data. windows.info extracts this directly from the kernel structures in memory, providing the build number and service pack level. The other plugins focus on registry hives, process listing, and command lines, none of which directly report the OS version in a concise manner.

The interactive user's identity is tied to the token of a process running in that user's session, such as explorer.exe. Extracting the token SID from explorer.exe's EPROCESS in the memory image confirms which account was interactively logged on. Other structures like KDBG or winlogon's EPROCESS do not directly hold the interactive user SID, making them unsuitable for this specific attribution.

Code injection often involves modifying existing memory segments or creating new ones with abnormal permissions. Analysts must look for areas of memory that are marked as executable but do not map to a file on disk (private memory), detect hooks in common system libraries, or identify discrepancies between memory-resident code and the original binary on disk. These indicators are classic signs that a process has been tampered with to execute malicious logic.

When a process is missing from the active process list but its object is still discoverable by scanning pool memory, the most likely explanation is that the list entry was removed to conceal the process. This is the classic signature of DKOM-based rootkit hiding, because the object remains allocated and its pointers are intact even though it is no longer linked into the list.

Cryptographic hashing immediately after acquisition establishes a verifiable integrity baseline for the memory image. Storing the image on the source host, using proprietary compression before hashing, or inspecting it in a hex editor does not provide that assurance and may introduce risk. Hashing is the standard, defensible method to demonstrate the image has not been altered.

The windows.modules plugin is designed to walk the kernel's loaded module list (PsLoadedModuleList) and display each module's name, base address, size, and path. This directly supports the analyst's goal of enumerating kernel modules from a memory image and comparing them against the operating system's reported list to identify discrepancies.

Standard process enumeration in Volatility relies on traversing the ActiveProcessLinks doubly-linked list rooted in the PsActiveProcessHead pointer. Advanced malware frequently unlinks EPROCESS structures from this list via direct kernel object manipulation to evade standard task manager visibility. Analysts must utilize kernel pool scanning plugins like pslist alternatives to recover these hidden entries.

windows.modules enumerates loaded kernel modules by traversing PsLoadedModuleList, yielding names, base addresses, and sizes suitable for baseline comparison. The other plugins target different artifacts: driverscan finds driver objects via pool scanning, svcscan lists services, and psscan recovers process objects. Only windows.modules directly satisfies the stated requirement on a Windows memory image.

The 'malfind' plugin scans memory for regions that are marked as executable (X) but are not backed by a file on disk (VAD tags). This is the standard method for finding shellcode or injected DLLs, which are common in fileless malware. It matters because attackers often use memory injection to bypass signature-based antivirus, and detecting these unbacked regions is the primary way to uncover such hidden malicious execution.

In Windows, every process is associated with a security token object that defines the user's identity, privileges, and groups. By extracting the security token structure associated with an EPROCESS object in memory, an analyst can determine the exact user context under which the process is executing. This is vital for determining if a process was launched with system privileges or by a compromised local user account during an incident.

Process injection typically manifests as executable memory that is not backed by a file on disk and as threads whose start addresses fall outside any mapped module. These two findings together provide strong evidence that an attacker wrote and executed code within another process, whereas handle counts, working set ratios, and AppData DLL loads have legitimate explanations and are not specific to injection.

The windows.ssdt plugin specifically parses the System Service Dispatch Table and compares each service routine pointer to the expected function address within the owning kernel module. Discrepancies indicate hooks, often used by rootkits to intercept system calls. The other plugins focus on callbacks, IRP handlers, or device trees, none of which directly analyze the SSDT for hooked entries.

The correct statements highlight that windows.psscan can reveal processes hidden from the active list and may also report terminated processes whose structures remain. These behaviors are essential for detecting rootkits that unlink processes. The other statements contain factual errors about the tools' methods or draw unsupported conclusions from identical output.

windows.pslist enumerates processes by following the active process list, which a rootkit can manipulate by unlinking its process. windows.psscan, however, scans memory for process objects using pool tags, which does not rely on the list. Therefore, in the presence of a process-unlinking rootkit, windows.psscan will detect the hidden process, resulting in a higher process count compared to windows.pslist. This discrepancy is a key indicator of hidden processes.

Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

A memory region with PAGE_EXECUTE_READWRITE protection, containing a PE header, and not backed by a file is a strong indicator of code injection. Legitimate processes rarely allocate such memory, and the presence of a PE header suggests a portable executable was loaded directly into memory. This is consistent with techniques like reflective DLL injection or process hollowing, where malicious code is executed within a trusted process to evade detection.

A process with a non-existent parent ID often points to a 'orphaned' process, which is common when the parent process has already exited or was hidden. This is a red flag for malicious activity, as rootkits or malware often spawn sub-processes and then terminate the parent to hide the chain of execution. Identifying this is key to reconstructing the infection vector and timeline during a forensic investigation.

To find drivers that were loaded and then unloaded, you need a plugin that scans kernel pool for module structures rather than relying on the active PsLoadedModuleList. windows.modscan performs exactly that pool scan and can recover residual module metadata, whereas the other plugins either list only active modules or focus on driver objects and IRP hooks, which would not reliably surface an unloaded driver.

The presence of the 'MZ' header (the magic bytes for a Windows PE executable) in a memory region that is not backed by a file on disk (VadS) and is marked as PAGE_EXECUTE_READWRITE is definitive proof of an injected executable. The malware has loaded a complete, valid PE file directly into memory to run its payload, which is a classic indicator of advanced fileless malware that bypasses file-system-based security controls.

To find the full path and access type of a file handle, you need a plugin that enumerates handles per process. windows.handles provides exactly that, showing the object name (full path) and granted access for each handle. The other plugins focus on scanning file objects without process association, listing loaded DLLs, or displaying privileges, none of which directly answer the question about a specific handle.

When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

The windows.pstree plugin is designed to display processes in a tree structure, showing parent-child relationships. This makes it easy to spot a svchost.exe with an unusual parent, such as a non-system process, which is a common sign of process spoofing. Other plugins like pslist, cmdline, and dlllist do not provide this hierarchical view, making pstree the correct choice for verifying process legitimacy.

The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

The combination of PAGE_EXECUTE_READWRITE protection and the absence of an associated file (File: None) is a classic indicator of malicious code injection. Normal applications rarely allocate memory that is simultaneously writable and executable, as this violates standard security practices like Data Execution Prevention (DEP). The lack of a file-backing suggests the code resides entirely in memory, a common technique for fileless malware to avoid detection by traditional on-disk antivirus scanners.