MOVP II – 4.5 – Mac Volatility vs the Rubilyn Kernel Rootkit
by Volatility | Jun 11, 2013 | forensics, kernel, macosx, malware, movp, volatility
In our final Month of Volatility Plugins post, we are going to demonstrate a number of plugins that can be used to detect kernel level OS X rootkits. To show these capabilities I am going to analyze a system that is infected with the rubilyn rootkit. I want to thank...MOVP II – 4.4 – What’s in Your Mac OSX Kernel Memory?
by Volatility | Jun 9, 2013 | forensics, kernel, macosx, movp, volatility
Today’s post will discuss a number of plugins that can retrieve forensically interesting information from within the kernel. Keep in mind, you can also use mac_yarascan to search kernel memory with yara signatures and you can use mac_volshell as an interactive...MoVP II – 3.5 – Utilizing the kmem_cache for Android Memory Forensics
by Volatility | Jun 4, 2013 | android, forensics, kernel, linux, malware, movp, volatility
This post will discuss utilizing plugins that leverage the kmem_cache in order to perform deep memory forensics of Android devices. In previous Linux posts, we have briefly mentioned these plugins, but a full walk through has not been done. Also, as we will see, these...MoVP II – 3.2 – Linux/Android Memory Forensics with Python and Yara
by Volatility | May 30, 2013 | android, forensics, kernel, linux, movp, volatility
In this post we will describe the Linux volshell and yarascan plugins. In previous releases of Volatility, these plugins only supported Windows samples, but starting with 2.3 you can interactively explore your Linux memory dumps (from a Python shell) or scan process...MoVP II – 2.5 – New and Improved Windows Plugins
by Volatility | May 28, 2013 | forensics, kernel, malware, movp, volatility, windows
The Volatility 2.3 release will include several new and improved Windows plugins. This post will summarize their purpose, point you to additional information if they’ve been mentioned in previous blog posts, and show example usage scenarios for the...
You must be logged in to post a comment.