Analyze Malicious Activity in Memory Using Volatility
Students will use the open source Volatility tool to analyze a memory snapshot and determine what malicious software has infected the victim machine.
Analyze Malicious Activity in Memory Using Volatility is a Cybrary Lab intended for students of Intermediate|Advanced level, Analyze Malicious Activity in Memory Using Volatility teaches how to perform an analysis of a memory snapshot and search for suspicious activity, collect and analyze invasion artifacts, such as source code, malware, and system configuration, as well as the use of these discovered data to allow mitigation of possible incidents.
This Lab is targeted toward Cyber Defense Incident Responder. Upon successful completion of Analyze Malicious Activity in Memory Using Volatility, the student will be able to perform the analysis of suspicious activity using this tool, locate and correlate indicators of compromise. Analyze Malicious Activity in Memory Using Volatility takes 1 hour to complete.
In the CybrScore’ lab Analyze Malicious Activity in Memory Using Volatility, students will learn about how to understand the behavior of suspicious processes and correlate evidence to prove that the specific process is of malicious origin. This lab provides a foundation for knowledge of malware analysis concepts and methodologies, an important decision-making process involved in the work of a Cyber Defense Incident Respondent, and malware analysis tools, a feature of Cyber Defense Forensics Analyst.
- Analyze a memory snapshot of a suspicious incident. For the analysis of an incident, it is necessary to establish controlled circumstances to evaluate all the issues involved, often the best way to do this is to take a snapshot. The student will learn in this lab how to work with snapshots produced by other professionals.
- Use the Volatility tool to locate and correlate suspicious activity in memory. In the Incident Response, the professional may encounter false positives and must have mastery of the technical and theoretical procedures to understand if the suspicious activity is indeed malicious or not.
- Finding compromise indicators is a way to gather enough elements into analysis so that all parties can be correlated to form a knowledge base about the behavior of malicious activity, identify which files are affected and in what form.
Reviewing forensic images, in this case, the snapshot in question, for the recovery of potentially relevant information is an activity involving several distinct procedures, with this course the student can practice the abilities studied in other courses here. This is a way to develop security in the manipulation of analysis and recovery tools, as well as to understand all the procedures involved.
Analyze Malicious Activity in Memory Using Volatility is part of the Cyber Defense Incident Responder. Completion of Analyze Malicious Activity in Memory Using Volatility means that the student has understood how to use Volatility to analyze suspicious files and determine if its behavior is dangerous.
Click on the launch button to start the lab.