Linux Memory Analysis

When investigating a cyber incident, a system's memory is one of the most volatile and revealing sources of evidence. Memory forensics helps uncover valuable information about what was happening on a machine at a specific time, such as running processes, open files, network connections, credentials, and more.

In this room, we will continue our investigation of the APT attack on the TryHatMe company and look at the footprints that the adversary left behind in the memory of the Linux machine. It is suspected that the adversary got access to the Linux server via lateral movement. 

Prerequisites

To understand the concepts and technicalities covered in this room, it is expected that the user is well-versed with Volatility and has covered the following rooms:

• Volatility
• Linux Live Analysis
• Windows Memory & User Activity
• Windows Memory & Processes

Learning Objectives

In this room, we will examine the footprints of the adversary's actions in the compromised Linux server. Some of the key topics that we will cover are:

• Overview of the Linux and Windows memory layout.
• Learn how to utilize Volatility to investigate Linux memory.
• Learn how to investigate the running processes and network connections and identify the odd ones.

Let's dive in.