When the EDR runs out of road: memory forensics for 400 SOC analysts
On 21 October we taught memory forensics at the Comunidad DOJO SOC Level 2 bootcamp. The case we walked through: a process-injection alert where the EDR could prove something was injected, but not what.
6 min read
On Wednesday 21 October we gave the memory forensics session of the SOC Analyst Level 2 bootcamp run by Comunidad DOJO. More than 400 analysts from across Latin America were in the call at one point or another, which makes it the largest room we have taught to.
We chose the topic because of a shift most SOC teams have already felt. The attacks that reach us now tend to arrive without a file worth scanning. The payload is assembled in memory, runs inside a process Windows shipped, and leaves very little on disk to submit anywhere. So we wanted to spend ninety minutes on the place that is hardest for an attacker to leave: RAM.
Why memory is worth the trouble
Everything that executed had to exist in memory at some point. That is the whole argument, and it holds no matter how careful the attacker was about disk.
A dump gives you processes and threads, open files and their contents, URLs and IP addresses, credentials, registry keys, command lines, and shellcode sitting in a region nobody wrote to disk. It is also the only place some attacks are visible at all. Process injection, reflective DLL loading, process hollowing, and most EDR-evasion tradecraft are memory-resident by design.
Acquiring the dump without ruining it
Half the session was acquisition, because this is where cases get damaged before they start.
The tools are not controversial: WinPmem, DumpIt, FTK Imager, LiME on Linux, or your EDR
directly — CrowdStrike will do it over an RTR session with xmemdump. The discipline around
them matters more than the choice.
Order of volatility. Acquire memory before anything else. Not after the reboot someone suggests while you are still on the call.
Driver signing. Windows Driver Signature Enforcement expects a signed driver, and whether your acquisition tool has one is something to find out before an incident rather than during.
Integrity. SHA-256 the image when it finishes. Record the tool, the version, the host, the time. A dump nobody can vouch for is a dump your client’s lawyers cannot use.
Take the page files too. pagefile.sys, swapfile.sys and hiberfil.sys sit on the root
drive and routinely hold pages that are no longer in RAM. The hibernation file is close to a
full snapshot of memory from an earlier moment, which is sometimes the moment you wanted.
The case: an alert the EDR could not finish
What follows is the scenario we built for the session. It runs on a lab host in our own CrowdStrike tenant, with the injection performed by an Atomic Red Team T1055 test rather than by a real intruder. We teach it with lab data on purpose: the method is the point, and the method is identical.
CrowdStrike raises a detection on notepad.exe. Suspicious process, review the process tree.
Checking the binary gets you nowhere, which is the first lesson.
The process tree is where it gets interesting.
CreateRemoteThread.exe runs against notepad.exe, and notepad.exe then launches
calc.exe. Ask yourself how often Notepad opens Calculator unprompted.
The EDR has told us a great deal. Something injected into a legitimate process, and that process then did something it has no business doing. What the EDR cannot tell us is what was injected. The telemetry describes the act. It does not contain the payload.
That is the moment to take a memory dump.
Four steps into the dump
We used Volatility 3 and worked the first four phases of the SANS six-step method.
Identify suspicious processes. windows.pslist shows notepad.exe at PID 6036 with a
parent of 4828 — and no process 4828 anywhere in the list. windows.psscan walks memory for
EPROCESS structures instead of following the active list, so comparing the two is routine.
Where they disagree, consider DKOM: an attacker who edits PsActiveProcessHead can unlink a
running process from the list Task Manager reads, without stopping it.
Analyse the process objects. windows.cmdline, windows.dlllist, windows.handles and
windows.getsids. Notepad was running as Administrator. Its handles included a directory
under AppData\Local\Temp. A DLL loaded from outside the system paths is always worth a second
look here.
Review network artefacts. windows.netstat for live sockets, windows.netscan to sweep
memory for structures including closed connections. The second one is where yesterday’s C2 tends
to surface.
Look for injected code. And this is where the lesson lands.
Why malfind found nothing
windows.malware.malfind is the obvious plugin, and it returned nothing for notepad.exe.
Malfind looks for regions that are private, executable, writable, and not backed by a file on disk. Sound logic. It is also published logic, and an attacker can read:
- Allocate the region as
READWRITE - Write the payload
- Flip it to
READEXECUTE - Run it
- Flip it back to
READWRITE
By the time anyone captures memory, the region reads as a plain writable allocation. Malfind walks straight past it. The code is still there.
So we stopped asking the tool and enumerated the process ourselves — windows.vadinfo --pid 6036 --dump to write out every region in the VAD tree, then read the headers.
xxd. The string calc is already legible in the ASCII column.
objdump. The instruction at offset 0xa is push 0x636c6163: four bytes that spell calc. The rest walks the PEB to find WinExec and calls it. There is the payload the EDR could see the effects of but not the contents.
A neighbouring region began MZ followed by !This program cannot be run in DOS mode, which is
a PE sitting in memory with nothing equivalent on disk.
The dump answered the question the EDR had raised and left open.
MITRE ATT&CK
Techniques covered in the session. These are the techniques we taught and demonstrated against a lab host, not findings from a client engagement.
| Tactic | Technique | ID |
|---|---|---|
| Defense Evasion | Process Injection | T1055 |
| Defense Evasion | Process Injection: Dynamic-link Library Injection | T1055.001 |
| Defense Evasion | Reflective Code Loading | T1620 |
| Defense Evasion | Rootkit | T1014 |
What we want analysts to take away
A clean hash proves nothing about behaviour. notepad.exe was genuine, signed and
untouched. The malicious part never had a file of its own.
Published detection logic is readable by both sides. Malfind is excellent and it has a documented blind spot. Knowing how your tooling decides is what lets you notice when a result is suspiciously quiet.
Memory forensics does not replace the EDR. It finishes what the EDR started. CrowdStrike found the activity, gave us the process relationships and the timeline, and told us where to point the microscope. The dump is what let us read the payload.
We also spent time on MemProcFS, which mounts a dump as a drive letter and is a gentler entry point than the Volatility command line for analysts starting out.
Working with us
Duntze Security runs managed detection and response and digital forensics for businesses across Panama and Latin America. The analysts watching your environment are the same ones who respond when something happens, and who teach sessions like this one.
If your EDR has ever told you that something was injected without telling you what, that gap is the one we close. Tell us what you’re protecting.
Available for talks and training on memory forensics, DFIR and SOC operations, in Spanish, English or German.