reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/detecting-process-injection-in-memory/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Detecting Process Injection in Memory
+
+## Overview
+
+`scripts/analyst.py` parses Volatility 3 `windows.malfind` text output and ranks processes by
+injection indicators: RWX private regions, PE/MZ headers and DOS stubs in private memory, and
+shellcode prologue bytes in the hexdump. It parses text only and executes nothing.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | regex, JSON, file IO |
+| volatility3 | latest | produces the `windows.malfind` input (run separately) |
+
+## Core functions
+
+### `score(path)`
+Returns ranked injection candidates with PID, cumulative score, and contributing reasons.
+
+## Scoring weights
+
+- RWX region: +3
+- PE/MZ in private memory: +3
+- DOS stub ("This program cannot be run"): +2
+- Shellcode prologue bytes: +1
+
+## Usage
+
+```bash
+vol -f memory.raw windows.malfind > malfind.txt
+python scripts/analyst.py score malfind.txt
+```
+
+## Sources
+
+- MITRE ATT&CK T1055 Process Injection — https://attack.mitre.org/techniques/T1055/
+- Volatility 3 documentation (windows.malfind, windows.vadinfo) — https://volatility3.readthedocs.io/
+- malfind RWX / private-memory PE heuristics from published memory-forensics practice