Results for “process-injection”
7 skills
mukul975 Hunting For Process Injection Techniques
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry.
24.6k · bundle
mukul975 Conducting Memory Forensics With Volatility
Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.
24.6k · bundle
mukul975 Extracting Memory Artifacts With Rekall
Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.
24.6k · bundle
More results
mukul975 Analyzing Memory Dumps With Volatility
Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials.
24.6k · bundle
mukul975 Detecting Fileless Attacks On Endpoints
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Provides detection rules for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware.
24.6k · bundle
mukul975 Detecting Evasion Techniques In Endpoint Logs
Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.
24.6k · bundle
mukul975 Performing Memory Forensics With Volatility3 Plugins
Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.
24.6k · bundle