Build exact CLI syntax and explore incident response playbooks for memory dump analysis. Formulates commands for code injection (malfind), hidden processes (psscan), active network sockets (netscan), and file dumping across Windows, Linux, and macOS.
Traverses the active process linked list (_EPROCESS) to display Process IDs, Parent PIDs, thread counts, handle counts, and process creation times.
Select a plugin below to configure command arguments and view investigative instructions.
In incident response and advanced threat hunting, volatile memory (RAM) analysis is the most conclusive method for detecting fileless malware, reflective DLL injection, and active network connections. Attackers can delete dropped payloads from the file system, but active code, unpacked executables, and unencrypted credentials unavoidably persist in volatile memory.
Historically, Volatility 2 required investigators to determine the exact patch build of the target operating system (e.g. Win10x64_19041). If the profile was mismatched, kernel data structures failed to parse. Volatility 3 eliminated this bottleneck by introducing Intermediate Symbol Files (ISF) generated from Microsoft PDB debug symbols, dynamically adapting to modern Windows 10 and 11 kernel structures.
windows.malfind scans memory pages allocated with PAGE_EXECUTE_READWRITE permissions that are not backed by an image file on disk, exposing reflective loaders and injected Cobalt Strike beacons.
Adversaries use Direct Kernel Object Manipulation (DKOM) to unlink malicious processes from pslist. Running psscan scans physical allocations to find hidden unlinked processes.
windows.netscan recovers closed and active TCP/UDP connections, associating external C2 IP addresses with the exact originating Process ID (PID).
Threat actors often disable ~/.bash_history on compromised Linux servers. The linux.bash plugin extracts live terminal command history directly from bash process memory.
| Investigation Goal | Volatility 3 Plugin | Typical Parameters | MITRE ATT&CK |
|---|---|---|---|
| Process Tree Analysis | windows.pstree |
-f mem.raw windows.pstree |
T1057 (Process Discovery) |
| Find Injected Code | windows.malfind |
-f mem.raw windows.malfind --dump |
T1055 (Process Injection) |
| Inspect Command Lines | windows.cmdline |
-f mem.raw windows.cmdline --pid 1420 |
T1059 (Command Interpreter) |
| Network C2 Beacons | windows.netscan |
-f mem.raw windows.netscan |
T1049 (Network Discovery) |
| Carve Executable Files | windows.dumpfiles |
--pid 1420 --dump-dir ./dump/ |
T1005 (Data from Local System) |
windows.pslist walks the active doubly-linked list of _EPROCESS blocks pointed to by the kernel. Rootkits can unhook themselves from this list (Direct Kernel Object Manipulation or DKOM). windows.psscan performs a pool-tag heuristic scan across raw physical memory to discover unlinked or terminated processes that pslist cannot see.
.vmem) to minimize RAM footprint. Never install software or run complex commands on an active incident machine prior to memory capture.