Topics:

• RAM structure (heap, stack, kernel memory)

• Process trees

• Why memory is key in modern IR

Topics:

• Memory acquisition tools

• Ensuring integrity

• Live IR considerations

• Kernel-level acquisition pitfalls

Topics:

• pslist, pstree, netscan, dlllist

• Detecting injected code

• Memory indicators of credential theft

• Investigating malicious processes

Topics:

• Rootkits

• Reflective DLL injection

• In-memory persistence