mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 17:47:16 +00:00
style: format all files with prettier
This commit is contained in:
@@ -12,6 +12,7 @@ Comprehensive techniques for acquiring, analyzing, and extracting artifacts from
|
||||
### Live Acquisition Tools
|
||||
|
||||
#### Windows
|
||||
|
||||
```powershell
|
||||
# WinPmem (Recommended)
|
||||
winpmem_mini_x64.exe memory.raw
|
||||
@@ -27,6 +28,7 @@ DumpIt.exe
|
||||
```
|
||||
|
||||
#### Linux
|
||||
|
||||
```bash
|
||||
# LiME (Linux Memory Extractor)
|
||||
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
|
||||
@@ -39,6 +41,7 @@ sudo cp /proc/kcore memory.elf
|
||||
```
|
||||
|
||||
#### macOS
|
||||
|
||||
```bash
|
||||
# osxpmem
|
||||
sudo ./osxpmem -o memory.raw
|
||||
@@ -83,6 +86,7 @@ vol -f memory.raw -s /path/to/symbols windows.pslist
|
||||
### Essential Plugins
|
||||
|
||||
#### Process Analysis
|
||||
|
||||
```bash
|
||||
# List processes
|
||||
vol -f memory.raw windows.pslist
|
||||
@@ -104,6 +108,7 @@ vol -f memory.raw windows.cmdline
|
||||
```
|
||||
|
||||
#### Network Analysis
|
||||
|
||||
```bash
|
||||
# Network connections
|
||||
vol -f memory.raw windows.netscan
|
||||
@@ -113,6 +118,7 @@ vol -f memory.raw windows.netstat
|
||||
```
|
||||
|
||||
#### DLL and Module Analysis
|
||||
|
||||
```bash
|
||||
# Loaded DLLs per process
|
||||
vol -f memory.raw windows.dlllist --pid <PID>
|
||||
@@ -128,6 +134,7 @@ vol -f memory.raw windows.moddump --pid <PID>
|
||||
```
|
||||
|
||||
#### Memory Injection Detection
|
||||
|
||||
```bash
|
||||
# Detect code injection
|
||||
vol -f memory.raw windows.malfind
|
||||
@@ -140,6 +147,7 @@ vol -f memory.raw windows.vadyarascan --yara-rules rules.yar
|
||||
```
|
||||
|
||||
#### Registry Analysis
|
||||
|
||||
```bash
|
||||
# List registry hives
|
||||
vol -f memory.raw windows.registry.hivelist
|
||||
@@ -152,6 +160,7 @@ vol -f memory.raw windows.registry.hivescan --dump
|
||||
```
|
||||
|
||||
#### File System Artifacts
|
||||
|
||||
```bash
|
||||
# Scan for file objects
|
||||
vol -f memory.raw windows.filescan
|
||||
|
||||
Reference in New Issue
Block a user