How to Find Hacker Traces in Memory Forensics

TL;DR

Capture memory before collecting disk evidence, because a memory dump can preserve commands, console output, tools, credentials, and other traces of an intrusion. Volatility commands such as cmdscan and consoles can reveal what an attacker typed and what the system returned, helping investigators reconstruct actions and distinguish interactive control from automated execution.

Transcript

How is everybody doing? Good? Excellent. Excellent. Wow, what an approach. I like that. Did you guys enjoy the music a little bit? Yeah? Finally. Okay, good, good. Fantastic. Um, so, uh, yeah, I think it's time to start the presentation. Uh, first of all, welcome, or welcome back, because I also see a couple of faces from the last year, and also th... Read More

Key Insights

• Memory acquisition is the first evidence-collection step described by the presenters, with disk collection performed afterward. This order matters because memory contains active and historical information that can disappear when a system is rebooted or its memory is wiped.
• A memory dump is an extensive source of forensic evidence, because it can retain commands, console output, credentials, tools, and information about the machine's state. Investigators can search these artifacts to reconstruct what occurred during an intrusion.
• Volatility is a Python module used in the demonstration to analyze a memory dump from a compromised system. Loading and searching the dump can take time, and the presenters note that having enough memory on the forensic workstation is useful.
• The cmdscan command searches a memory dump for patterns associated with commands issued through consoles such as CMD. Recovered command history can show what an attacker attempted, which tools were used, and how activity progressed on the compromised machine.
• The consoles command can recover both issued commands and their resulting console output. This gives investigators more context than command history alone, including information about the system's state and results produced by attacker tools.
• Mimikatz activity is visible in the demonstrated memory evidence, including commands involving debug privilege and LSA login passwords. Its console output also exposes a password associated with Paula's PC, showing that sensitive results can remain recoverable in memory.
• A misspelled command is evidence consistent with interactive control, according to the presenters. They reason that a person operating the compromised machine remotely was more likely responsible than malware or an automated script executing a fixed sequence.
• Incident-response delays can leave an organization exposed for months. In the customer example, the compromise happened in June but reached the presenters in October, while an unresolved process identified during an earlier investigation was allowed to continue running.

Questions & Answers

Q: How should investigators begin collecting evidence from a compromised computer?

Investigators should capture a memory dump before collecting disk evidence, according to the presenters. Memory can preserve active processes, commands, console output, credentials, and other traces that may disappear after a reboot or memory wipe. Capturing it first protects volatile information and provides material for reconstructing what the attacker did on the compromised system.

Q: What can a memory dump reveal about a cyberattack?

A memory dump can reveal commands issued by an attacker, the output returned by consoles, tools used during the intrusion, credentials displayed in memory, and details about the machine's state. The presenters describe memory as containing an encyclopedia of information and use it to recover evidence that helps explain how an attack unfolded.

Q: How does Volatility help analyze a compromised system?

Volatility is used as a Python module for examining a memory dump taken from a hacked system. It searches the dump for recognizable patterns and recovers forensic artifacts such as console commands and their output. The analysis may take time because the dump must be loaded and searched, so sufficient memory on the analysis computer is useful.

Q: What does the Volatility cmdscan command recover?

The cmdscan command searches a memory dump for commands issued through command consoles such as CMD. Its results can identify attacker actions and tools, providing useful material for understanding how the intruder operated. In the demonstration, recovered activity includes ps.exe, Mimikatz, a debug privilege command, and an LSA login-password command.

Q: What is the difference between cmdscan and consoles in Volatility?

The demonstrated cmdscan command focuses on commands that were issued through a console. The consoles command provides additional context by recovering console output as well as command activity. That output can show what a tool returned, reveal credentials, and document the system's state, helping investigators interpret the meaning and consequences of the recovered commands.

Q: How can investigators identify interactive attacker activity in memory?

A typing error in a recovered command can indicate that someone controlled the machine interactively. In the demonstration, a misspelling leads the presenters to conclude that a remote person was probably entering commands rather than malware or an automated script executing them. The observation comes from examining recovered console history within the system's memory dump.

Q: Why can hidden attacker activity still be found in memory?

The presenters explain that anything operating on a system must exist in memory, so malicious activity cannot be completely hidden while it is working. Attackers may conceal files or traces from ordinary observation, but memory analysis can expose commands, processes, output, tools, and credentials. Rebooting the system or wiping memory can remove this volatile evidence.

Q: What incident-response mistakes appear in the customer case?

The customer waited from June until October to involve the presenters, left an unresolved malicious process running, and sent an investigation report without encryption. The organization then spent weeks discussing monitoring arrangements before sending a domain administrator username and password in clear text. These actions delayed investigation and created additional exposure around highly privileged access.

Summary & Key Takeaways

• The presenters introduce forensic methods for investigating hackers who attempt to hide their traces. A customer incident involving a suspected $1.9 million loss illustrates serious response failures, including delayed escalation, unresolved malicious activity, unencrypted reporting, weeks of inaction, and domain administrator credentials being sent in clear text to external investigators.

• Evidence collection should begin with a memory dump before investigators collect disk evidence. Memory can contain extensive information about an attack, including console commands, command results, tools, credentials, and system state. Because working components must exist in memory, investigators may recover traces even when attackers try to conceal their activity elsewhere.

• Volatility provides practical commands for examining captured memory. The cmdscan command searches for commands issued through consoles, while consoles can recover both commands and their displayed results. In the demonstration, investigators identify ps.exe, Mimikatz activity, a debug privilege command, an LSA password command, misspelling, and exposed credentials in console output.