Digital › Module 5 › Lesson 2
Process Artifacts
Process artifacts name PID, PPID, cmdline, DLLs, and handles in RAM — interpret on YOUR $DFIR_LAB dumps without tampering.
Visual · t26_process_artifacts
Process artifact literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Malware hides in process trees — literacy reads parent/child, path, and command line before disk corroboration.
Process listings show executable path, process ID, parent ID, start time, and command-line arguments (when preserved). DLL lists reveal injected libraries. Handle tables show open files and mutants — advanced literacy. Compare memory process list to disk autostart — discrepancies warrant deeper review. Cyberlium documents process artifact fields on YOUR $DFIR_LAB — label course malware samples as lab — never fabricate process trees on unauthorized captures. Next: Memory Order.
1. Key process fields (named)
PID/PPID: parent-child relationships expose spawn chains. Image path: legit path vs temp folder. Cmdline: arguments revealing encoded payloads or admin tools — handle sensitive data carefully in notes.
On $DFIR_LAB dump, document one benign and one lab-malicious process row — fictional names OK if course-labeled.
Command guide
Try these commands — Key process fields (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Volatility 3 — https://github.com/volatilityfoundation/volatility3 (optional install literacy) Volatility docs — https://volatility3.readthedocs.io/en/latest/ SANS memory forensics — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}optional: version check if Volatility installed — literacy only
Command — copy this
command -v volatility3 >/dev/null && volatility3 -h | head -5 || vol.py -h 2>/dev/null | head -5 || echo 'Volatility not installed — curl docs above for literacy' grep -E 'never|stranger|RAM' "$LAB_DFIR/notes/no-stranger-evidence.txt" curl -sS https://github.com/volatilityfoundation/volatility3 | head -5
Primary tools to practice this lesson: curl, grep. Reference sites: Volatility 3 (https://github.com/volatilityfoundation/volatility3); Volatility docs (https://volatility3.readthedocs.io/en/latest/); SANS memory forensics (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Corroboration habit
Memory-only process with no disk backing may indicate injection or transient loader — hypothesis, not automatic guilt. Pair with disk timeline, net connections, and logs.
Reports cite plugin name, UTC time, and exhibit ID — reproducibility matters.
3. Ethics in artifact reporting
Forbidden: inventing cmdline evidence, editing dump bytes, or exfiltrating live credentials from practice dumps to chat. Allowed: process artifact glossary — five fields with defender meaning.
Ship: process artifact glossary tied to $DFIR_LAB example row. Next: Memory Order.
4. What you ship: process artifact glossary for $DFIR_LAB
Five fields with meanings, one example row. $DFIR_LAB named. NEVER fabricate artifacts. chmod 600.
5. What you record before the next lesson
Date. Process glossary. $DFIR_LAB named. File t26-m05-l02-process-artifacts.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fabricate cmdline proving a narrative. Share credential strings from dumps publicly.
Right
Write process artifact glossary for YOUR $DFIR_LAB dump. Next: Memory Order.
Mission: read one process row in YOUR lab
1) Define PID and PPID. 2) Explain why cmdline matters. 3) Note one corroboration source (disk/log). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Parent spawned from unexpected path is a classic triage cue.
Knowledge Check
APPLY: Process artifacts in memory include:
Multiple choice
Knowledge Check
APPLY: True or False: Memory process lists should be corroborated with disk or logs when possible.
True or False
Knowledge Check
APPLY: Fabricating process evidence is:
Multiple choice