資安鑑識-Memory Analyzing

主要利用volatility framework 2.6執行

識別system profile

python vol.py -f %image\_name% imageinfo

pslist

pstree

cmdscan

延伸閱讀

• [轉]藍隊訓練
• [轉]病毒分析教學 Malware-Analysis-Training
• 藍隊營運Blue Team Operations [Part 1]: How Corporate and Enterprise SOC Operate?
• 藍隊營運Blue Team Operations [Part 2]: How To Investigate Malware Incidents as a SOC Analyst