Welcome to OS Analysis with Volatility.
My name is Tim Coakley, and I'll be your instructor for this course.
Let's get started with some background information about Volatility.
Volatility was originally created by AAron Walters and the Volatility Foundation
team and has been actively maintained for many years and is publicly available
on GitHub and the Volatility Foundation website.
Volatility complements existing blue team security tooling by
allowing you to analyze the volatile memory of systems for
evidential artifacts of importance.
These artifacts may be part of running processes at the time of capture
and sometimes be the only source of vital evidence.
This is a unique and somewhat detailed feature that
addresses a security gap in many environments.
Volatility uses the command line to operate and is
relatively simple to configure and use.
This tool can be used to assess multiple memory image
formats specific to your security requirement.
It's available as open source and is free to download from GitHub.
Volatility also comes with the option to convert memory
images from one format to another.
And in addition to this,
a number of prebuilt plugins are available to support data extraction.
Plugins are the real power behind this framework as they
extend the capabilities of the tool to be able to extract
even more information from memory.
This, combined with the command line, makes the output very flexible.
You may only need to use specific plugins tailored to
your own security requirements.
The flexibility extends to being able to create your own
plugins for very specific requirements,
so there's no need to wait for the creator to update.
Reporting can be displayed on screen or sent to a
file or other automated processes.
Before I cover the details of using Volatility and the technical commands,
it's worth covering and understanding cybersecurity frameworks.
There are several frameworks available,
and the choice depends on your organization needs
to decide the most appropriate.
NIST is one organization that produces cybersecurity
frameworks and encompasses a set of standards,
guidelines,
and best practice to achieve a suitable level of
improved cybersecurity maturity,
which you can see here are covered under the categories Identify,
Protect, Detect, Respond, and Recover.
Each category contains subcategories that are linked to
specific activities an organization needs to perform to
improve its cybersecurity maturity.
Volatility is a tool that helps an organization with
the Anomalies and Events category.
We can further narrow down the subcategories that link this
technology to specific technical activities.
Volatility is a very niche tool for specific use cases,
but it's still invaluable for helping and enabling security professionals
to analyze findings and understand the targets at risk.
This can lead to understanding the methods used,
as well as the potential future impact.
Overall,
this helps better inform an organization and help prepare for future security
strategies to improve security and further mitigate risk.
Volatility forms part of the event data and correlation process.
The output from the tool can determine what impact malicious events may have.
The output from Volatility can also help determine suitable thresholds for
security alerts and help create new or improved detection rules.
This course will demonstrate how to use Volatility and link
to the concepts being discussed here.
We also have the MITRE ATT&CK,
which provides different techniques a threat actor
mere use against your organization.
In this course,
we will look at command and script interpreter and process injection.
We want to identify and know which commands,
if any, have been entered into the command prompt,
perhaps by an attacker.
This type of indicator of compromise is very powerful evidence and can
show just exactly what commands were used and why.
We're going to look at process injection,
which is a technique commonly used to execute malicious code on a
system that potential attackers could use to conduct reconnaissance
on your environment or even use the hidden processes to exfiltrate
data out of your organization.
With an ever‑complex interconnected work environment,
it's more important than ever to know what has occurred when a
serious security incident impacts your organization.
Finally,
MITRE SHIELD is one framework that covers attack techniques and how you
can defend your environments against these attacks.
Using this, we can link the attack techniques with the methods of defense.
These include DTE0034 ‑ System Activity Monitoring.
A defender can detect the presence of an adversary by
monitoring for processes that are created by commands or
scripts that they execute on a system.
There is also DTE0032 ‑ Security Controls.
A defender can block execution of untrusted software.
We will look at one method of protecting from malicious processes,
which could be deployed to help prevent attackers
from targeting your organization.
So where does Volatility sit within your organization?
And the answer depends on your organization and its overall maturity.
The process of capturing memory, then analyzing at this level,
while providing important benefits, does come with some process overhead.
This process and use of Volatility will likely only be reserved
for security incidents where there is a high degree of certainty
a compromise may have occurred.
It's certainly not a process that could be performed multiple times
per day as this would result in stack exhaustion.
A target computer system, which could be a corporate machine or a server,
is identified,
and a capture of the current contents of volatile computer RAM is taken.
It's worth noting the capture process is not covered in this course,
but the RAM capture is saved as a file and transferred
to the security team for analysis.
As illustrated here,
the security rules may vary depending on the job roles and skills,
and it's not uncommon for an analyst to perform the duties of multiple roles.
As I mentioned,
multiple security roles will have an interest in analyzing volatile memory.
This could be incident responders who will perform an
initial triage to support an incident.
If an incident is at a certain severity and there
is an indication of compromise, for example,
it could be a malware analyst for in‑depth analysis to determine how a
particular malware operates and how it's affected systems.
This could be the only source of evidence malware is present on the system,
and this type of analysis can be much more detailed and very technical,
often accompanied by a detailed report, and not all organizations may need this.
Finally,
it could be a forensic analyst who needs to prove user intent to support
investigation and the results of which may go to legal proceedings.
This type of role will often be part of a large
investigation and accompanied by detailed reports,
but explained to a broad audience, including non‑technical members and managers.
In each scenario,
volatile memory analysis has unique benefits beyond
many other cybersecurity capabilities.
As I mentioned briefly,
an image copy of volatile memory needs to be taken
from the target computer system,
which results as a file that needs to be stored somewhere securely.
It's this file that is analyzed by Volatility.
The methods of memory capture are not covered in this course,
but are well documented on the Volatility resource website.
This course will not cover the installation steps as this is
covered in the Volatility GitHub page.
As you follow along,
you'll be able to take away the ability to understand memory
analysis to fulfill specific use cases.
This will help you to understand an attacker's motor versions,
tools, and techniques when trying to access your organization's environments.
Cybersecurity in general is a challenging and exciting
area for security professionals,
and Volatility is one of the many useful tools that will
help you to defend your organization.
So with that,
let's get into learning the benefits of Volatility and how to
use it to help secure your organization.