Finding Evil Fast: Windows Memory Triage with Volatility 3

No ratings

Presented at BSidesAugusta 2026 by

Andrew Case

Memory analysis is an essential investigative technique for detecting modern, memory-resident malware. Unfortunately, it is often perceived as a difficult and manual process requiring expert knowledge of operating systems and malware internals. This talk challenges that assumption by presenting five checks that can be automatically performed against Windows memory samples to quickly surface signs of malicious code execution or attacker access. The presented checks answer five critical triage questions: 1) are any processes running with unexpected privileges, 2) are restricted resources being accessed by unexpected processes, 3) are any processes executing code in a suspicious manner, 4) has malware entered the kernel, and 5) does any process or kernel driver match known threat intelligence? All checks will be demonstrated using Volatility 3, the most widely used open source framework for memory analysis. Attendees will leave with a compact workflow that SOC analysts, threat hunters, and incident handlers can use to automatically identify memory-only malware, toolkits, and attacker activity, helping them rapidly prioritize systems during large-scale triage and decide where deeper forensic analysis is warranted.