Capture, analyze, and report, live memory investigation exercises for hidden processes and credential theft
Brightline Media Group's SOC flags anomalous outbound traffic from an editing workstation. Responders capture a RAM image before pulling the host offline. Analyze the simulated Volatility output to find the hidden malicious process, determine how it evaded detection, confirm what it accessed, and identify its command-and-control endpoint.
Nightly build times at Ferrovia Robotics have tripled, and the platform team's monitoring shows one Jenkins CI runner pinned at 100% CPU around the clock. Before rebooting it, they capture a memory image of the Linux build agent. Determine what's actually running, how it got there, and where it's phoning home.
Meridian Health Systems' EDR agent went silent on a domain controller at 03:41, with no corresponding uninstall or crash report. A memory image was captured before anyone touched the box. Determine how the EDR was disabled and what, if anything, ran afterward.
A file server at Castellan Wealth Partners shows a spike in SMB traffic to workstations that have no business reason to talk to it. No malware was ever written to disk. Analysts capture memory from the file server and one of the destination workstations to determine whether this is lateral movement, and if so, how the attacker is doing it without leaving a file behind.
Arclight Streaming's EDR fires a 'process injection' alert on a kiosk workstation: malfind flags a PAGE_EXECUTE_READWRITE region with no backing file inside a chrome.exe renderer process, and a similar RWX region inside virtually every other process on the host. A junior analyst wants to escalate the chrome.exe hit as confirmed injection. Determine whether either RWX finding is actually malicious, and find what is.
A help-desk technician's workstation at Meridian Health Systems briefly showed a console flash before returning to normal. Nothing was flagged by antivirus. A memory image was captured during a routine EDR sweep an hour later. Determine whether credentials were actually dumped from this machine, and how, given that the process that did it has already exited.
Castellan Wealth Partners' public-facing IIS server keeps handling suspicious admin-panel requests that don't correspond to any file on disk, and the server has already been fully patched and scanned clean by an automated vulnerability scanner. Analysts capture memory from the web server while it's still live. Determine how requests are being served with no matching file, and what the attacker can actually do through it.
A backend API server at Ferrovia Robotics is intermittently unresponsive, but `top` and `ps` on the live box show nothing unusual and CPU graphs look normal. Before rebooting, the platform team captures a memory image of the Linux host. Determine whether something is actually hidden from the tools they already ran, and what it's doing.
A workstation at Castellan Wealth Partners has been beaconing to an external IP with jittered, irregular timing that evaded a simple frequency-based network detection rule for weeks. A memory image is captured. Determine what's actually generating that traffic and extract enough from memory to know exactly what the implant is configured to do next.
A trader at Lindqvist Capital Partners insists a large USDT transfer went to a wallet address he never typed. IT rules out a phishing email and a malicious browser extension. Analysts capture memory from his workstation. Determine whether something is intercepting his clipboard, given that the process holding it shows no obvious injection under a routine scan.