Lion Cipher Lab
Read Volatility process output: spot hidden, masquerading, and injected processes
- Digital Forensics & IR (DFIR)
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A process listing is the first thing every memory examiner reads and the thing juniors most often misread. The trap is that there is no single 'process list' — Volatility can build one three different ways (walk the kernel's linked list, scan raw memory for process objects, or arrange them by parent), and the ways they DISAGREE are themselves the evidence. A process that the pool scan finds but the linked list cannot is either a boring terminated process or a rootkit hiding in plain sight, and knowing which is a skill, not a lookup. Attackers count on you skimming: they name their implant…
What you'll learn
- reading windows.pslist, windows.psscan and windows.pstree and knowing what each one actually measures
- interpreting a pslist-vs-psscan discrepancy: what the linked list hides and the pool scan finds
- telling a deliberately-hidden (unlinked) process from a merely-terminated one using the exit-time column
- knowing the canonical Windows process genealogy (who should spawn lsass, services, svchost) so anomalies stand out
- spotting a masquerading process by name, image path and parent — svch0st.exe from Temp under powershell.exe
- reading a suspicious parent-child chain (Office -> script host -> child) as an execution story
- corroborating a finding across plugins (netscan, cmdline) before you conclude
- judgment: when a process listing answers the question and when you must dump and go deeper (malfind/YARA)
Steps in this lab
- Three ways to ask 'what was running?' — and why they disagree on purpose
- Know normal before you hunt evil: the canonical Windows genealogy
- The evidence, part 1: the two process lists
- Spot the hidden process: psscan minus pslist, then read the exit-time column
- Spot the masquerade: a system name in the wrong clothes
- Read the chain as an execution story (Office -> script host -> child)
- Corroborate before you conclude: what was it talking to?
- When the listing answers it — and when you must dump and go deeper
- How a pro reads this, in order — the habit worth keeping