Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.
You have a Windows memory image and want to find injected/hollowed code.
You are triaging private RWX regions, unbacked executable memory, and PE headers in private
allocations (classic injection/hollowing signs).
Do not use this on a live production host without authorization — work from an acquired image.
This skill interprets analysis output; run Volatility separately on the image.
Prerequisites
A memory image and Volatility 3 (windows.malfind, windows.vadinfo) installed.
Safety & Handling
Treat carved injected regions as live malicious code; store them password-protected.
Workflow
Step 1: Run malfind and capture output
vol -f memory.raw windows.malfind > malfind.txt
Step 2: Score injection candidates
python scripts/analyst.py score malfind.txt
Flags regions with PAGE_EXECUTE_READWRITE, MZ/PE headers in private memory, and shellcode-like
disassembly hints, ranking processes by suspicion.
Step 3: Corroborate
Cross-check flagged PIDs with windows.vadinfo (private, executable, no mapped file) and the
process tree for anomalous parents.
Step 4: Carve and route
Carve the injected region for follow-on shellcode/PE recovery and analysis.
Validation
Flagged regions are private + executable, not legitimate mapped images.
PE-in-private-memory findings are confirmed by an MZ/This program signature.
High-scoring PIDs corroborate with VAD protections and process-tree anomalies.
Pitfalls
JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
Relying on malfind alone; pair with vadinfo and ldrmodules.
Missing hollowing where the region is RX (not RWX) after protection change.
