MoVP 1.1 Logon Sessions, Processes, and Images
by Volatility | Sep 10, 2012 | forensics, kernel, movp, rdp, volatility, windows
Month of Volatility Plugins Attackers like to log on. They specifically like logging on remotely with RDP. Whenever these actions occur, the Windows kernel creates a new session, which is basically a container for processes and objects (like window stations and...
You must be logged in to post a comment.