1.2 KiB
1.2 KiB
API Reference: Detecting Process Injection in Memory
Overview
scripts/analyst.py parses Volatility 3 windows.malfind text output and ranks processes by
injection indicators: RWX private regions, PE/MZ headers and DOS stubs in private memory, and
shellcode prologue bytes in the hexdump. It parses text only and executes nothing.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | regex, JSON, file IO |
| volatility3 | latest | produces the windows.malfind input (run separately) |
Core functions
score(path)
Returns ranked injection candidates with PID, cumulative score, and contributing reasons.
Scoring weights
- RWX region: +3
- PE/MZ in private memory: +3
- DOS stub ("This program cannot be run"): +2
- Shellcode prologue bytes: +1
Usage
vol -f memory.raw windows.malfind > malfind.txt
python scripts/analyst.py score malfind.txt
Sources
- MITRE ATT&CK T1055 Process Injection — https://attack.mitre.org/techniques/T1055/
- Volatility 3 documentation (windows.malfind, windows.vadinfo) — https://volatility3.readthedocs.io/
- malfind RWX / private-memory PE heuristics from published memory-forensics practice