SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
detecting-process-injection-in-memory
0
Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Detecting Process Injection in Memory ## When to Use - You have a Windows memory image and want to find injected/hollowed code. - You are triaging private RWX regions, unbacked executable memory, and PE headers in private allocations (classic injection/hollowing signs). **Do not use** this on a live production host without authorization — work from an acquired image. This skill interprets analysis output; run Volatility separately on the image. ## Prerequisites - A memory image and Volatility 3 (`windows.malfind`, `windows.vadinfo`) installed. ## Safety & Handling - Treat carved injected regions as live malicious code; store them password-protected. ## Workflow ### Step 1: Run malfind and capture output ```bash vol -f memory.raw windows.malfind > malfind.txt ``` ### Step 2: Score injection candidates ```bash python scripts/analyst.py score malfind.txt ``` Flags regions with `PAGE_EXECUTE_READWRITE`, MZ/PE headers in private memory, and shellcode-like disassembly hints, ranking processes by suspicion. ### Step 3: Corroborate Cross-check flagged PIDs with `windows.vadinfo` (private, executable, no mapped file) and the process tree for anomalous parents. ### Step 4: Carve and route Carve the injected region for follow-on shellcode/PE recovery and analysis. ## Validation - Flagged regions are private + executable, not legitimate mapped images. - PE-in-private-memory findings are confirmed by an MZ/`This program` signature. - High-scoring PIDs corroborate with VAD protections and process-tree anomalies. ## Pitfalls - JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting. - Relying on malfind alone; pair with vadinfo and ldrmodules. - Missing hollowing where the region is RX (not RWX) after protection change. ## References - See [`references/api-reference.md`](references/api-reference.md) for the scorer. - ATT&CK T1055 and Volatility 3 docs (linked in frontmatter).