← incident responder
Take Quiz →
Memory Forensics — Advanced Volatility, Rootkits, and Credential Extraction
advanced 5h
Go beyond basic Volatility plugins — analyze kernel structures, detect rootkit manipulation, extract credentials from LSASS and browsers, and triage memory images at IR speed.
Lessons
1 EPROCESS and Windows Process Structures — What Memory Contains
25 min 2 Code Injection Detection — malfind, ldrmodules, and Hollowing
25 min 3 Credential Extraction from Memory — LSASS, Mimikatz Artifacts, and Browser Credentials
25 min 4 Rootkit Detection — DKOM, SSDT Hooks, and Kernel Integrity
20 min 5 MemProcFS and Rapid Memory Triage — Filesystem-Style Analysis
20 min Module Quiz
Test your knowledge before moving on.