Reading Time: 6 minutes

TL;DR Memory forensics is critical for catching the volatile indicators of compromise (IoCs) that disk-based analysis misses, but the field still lacks a unified, repeatable methodology: most investigations remain ad hoc, tool-specific, and hard to reproduce. In our recent paper at ICDF2C 2025, “Toward Structured Memory Forensics: A MITRE ATT&CK-Aligned Workflow for Malware Investigation”, we propose a five-phase methodology that takes an analyst from initial evidence preservation all the way to binary program analysis, with each phase explicitly mapped to MITRE ATT&CK adversary tactics and techniques. We also identify four technical challenges (paging, demand paging, smearing, and runtime binary transformations) that bias memory evidence, and outline concrete future research directions to mitigate them. Interested? Keep reading this briefing or grab the full paper here.

Why Memory Forensics Still Lacks a Unified Methodology

Memory-resident malware (fileless implants, injected code, decrypted payloads, in-memory C2 sessions) is now a defining feature of modern threats. Memory forensics is the discipline that gets at this volatile evidence, and tools such as Volatility have matured into industry-standard staples. Despite that, the way analysts actually conduct memory-based malware investigations is still surprisingly fragmented: every team has its own recipe, every report a different shape, and reproducibility (a baseline requirement in any forensic discipline) suffers as a result.

The contrast with neighboring fields is telling. Disk forensics has consolidated around frameworks such as NIST SP 800-86 and ISO/IEC 27037, supported by mature tools such as The Sleuth Kit and Autopsy. Mobile and cloud forensics have likewise developed platform-specific structured approaches. Memory forensics, however, lacks a comparable unified methodology dedicated to memory-resident IoC extraction and analysis. Existing work tends to focus on individual artifacts or heuristics: keylogger detection plugins, USB attack analysis, voting-based evaluation methods for IoC tools, and so on, each excellent in isolation but not part of a coherent investigative pipeline.

The Solution: A Five-Phase, ATT&CK-Aligned Workflow

Our paper does not propose a new detection algorithm or yet another forensic plugin. Instead, it offers a structured synthesis of widely adopted but fragmented practices in memory-based malware investigation, organized into a phased methodology and explicitly aligned with the MITRE ATT&CK framework. The goal is to operationalize existing knowledge, turning a body of expert know-how into a repeatable, tactics-based process that incident responders and investigators can apply consistently.

The methodology is built around two ideas:

  • A scaling model for the phases. They are ordered from structural preservation and low-level entropy/byte-pattern inspection up to semantically rich reconstruction of process and binary behavior. Each phase builds on the findings of the previous one, narrowing hypotheses and reducing the risk of misattribution in earlier, noisier stages.
  • An explicit mapping to ATT&CK tactics and techniques. By tying each phase to the kind of adversary behavior it is best positioned to detect (e.g., obfuscated files or information T1027, process injection T1055, registry/startup folder execution keys T1547.001, application layer C2 T1071.001, reflective DLL injection T1055.002), the workflow connects forensic findings to the operational threat model they should inform.

Inside the Five Phases

The methodology unfolds in five well-defined phases:

  • Phase 1 — Evidence Preservation and OS Characterization. The memory dump is write-locked and cryptographically hashed (MD5/SHA-1/SHA-256) to guarantee integrity. The operating system version, architecture, and memory layout are then identified using Volatility plugins such as imageinfo (Volatility 2) or banners and info (Volatility 3). This profile is what makes every later artifact interpretable.
  • Phase 2 — Raw Data Analysis. The dump is examined at the byte level, regardless of OS abstractions. Entropy heuristics, binary carving (binwalk, bulk_extractor), and YARA rules detect embedded payloads, encrypted regions, and residual shellcode. Volatility’s yarascan, malfind, and strings zoom in on suspicious memory pages, RWX regions with minimal structure, and latent attacker commands. This phase obviates the dependency on kernel-level metadata, providing resilience against rootkits that manipulate system structures.
  • Phase 3 — File Data Analysis. File-level artifacts (deleted executables, configuration files, embedded payloads) are reconstructed using carving tools such as bulk_extractor, foremost, scalpel, or binwalk, and validated against threat intelligence (VirusTotal, MalwareBazaar). Discrepancies between file extensions and magic bytes, falsified PE timestamps, or altered import tables surface techniques such as ingress tool transfer (T1105) and masquerading (T1036).
  • Phase 4 — Volatile Data Analysis. Dynamic runtime structures (processes, threads, sockets, registry hives, drivers) are analyzed with pslist/psscan/pstree, netscan/netstat/connscan, and svcscan/modules/ldrmodules. In-memory hive analyzers (printkey, hivelist) reveal volatile registry modifications absent from disk images, especially relevant for ASEP-based persistence and fileless malware.
  • Phase 5 — Binary Program Data Analysis. Suspicious binaries identified earlier are dumped (memdump, procdump, dlldump, pedump) and reverse-engineered with disassemblers and debuggers (Ghidra, IDA Pro, Radare2) to reconstruct control flow and detect injected code, opaque predicates, or anti-analysis tricks. Because memory-resident binaries often lack symbol tables, relocation data, or digital signatures, similarity digest algorithms (such as TLSH, ssdeep, or sdhash) and tools such as Diaphora or Bindiff are key to recovering missing metadata, enabling family attribution, and matching partial binaries against disk-resident references.
Figure 1: The proposed 5-step methodology for malware-related IoC extraction and analysis in memory forensics.

Technical Challenges That Bias the Evidence

A central contribution of the paper is the integrative discussion of four technical challenges that compromise the integrity and completeness of in-memory evidence. These are well-known individually, but the paper revisits them from a tool-centric, methodology-aware perspective and identifies underexplored gaps:

  • Paging. Pages may be evicted to the pagefile before acquisition, leading to incomplete extractions and misleading byte-level comparisons. Current tools such as Volatility do not analyze pagefiles directly; integrating pagefiles with memory dumps and using approximate matching to recover content integrity remain open problems.
  • Demand Paging. Lazy loading means that important code, including library functions, may never be loaded into RAM during a process’s lifetime. The result is partial binaries and inconsistencies between processes that share libraries. System-level extraction approaches that aggregate shared pages across processes can help, but mixing modified shared regions remains a risk.
  • Smearing. When dumps are acquired from live systems without hypervisor support or system pause, race conditions corrupt high-level structures: process trees, loaded modules, pointers. Sophisticated malware can deliberately induce such inconsistencies. Temporal forensics (timestamping memory regions and reporting potential inconsistencies to analysts) is a promising direction.
  • Particular Characteristics of Binary Programs. Relocations, symbol resolution, and signature stripping mutate the binary structure in memory. Extracted binaries may be incomplete, differ between processes, or lack original signatures, which limits static analysis and complicates behavioral attribution. Combining memory binaries with their disk-resident equivalents to regenerate symbol tables or verify integrity is an active line of work, but reliable tools are still in their early stages.

Takeaways for Incident Responders

The methodology is meant as a set of best practices rather than a black-box tool. Incident responders and investigators can:

  • Replace ad-hoc plugin combinations with a phased, repeatable pipeline that is easier to document, peer-review, and reproduce in court.
  • Communicate findings to non-technical stakeholders through ATT&CK alignment, mapping observed artifacts to known adversary tactics and techniques.
  • Use the four challenges as a reliability checklist when interpreting memory evidence: any IoC drawn from a single phase should be cross-checked against disk-resident artifacts, similarity digests, or temporal markers when these challenges are in play.
  • Prioritize tooling investment in the directions the paper outlines: pagefile integration, derelocation and similarity-based validation, and reproducible benchmarks for memory forensic tools.

Companion Tooling

While the paper deliberately stays at the methodology level, the workflow has informed our open-source tooling. In particular, BinTopsy operationalizes several of the steps (entropy visualization, YARA scanning, function-level similarity hashing, MITRE ATT&CK capability mapping, and structural diffing) into a single Python toolkit. Readers interested in putting the methodology into practice can use BinTopsy as a starting point (we will write a related post on this tool soon).

Funding Acknowledgments

This research was supported in part by grant PID2023-151467OA-I00 (CRAPER), funded by MICIU/AEI/10.13039/501100011033 and by ERDF/EU, by grant TED2021-131115A-I00 (MIMFA), funded by MICIU/AEI/10.13039/501100011033 and by the European Union NextGenerationEU/PRTR, and the University of Zaragoza, by grant Proyecto Estratégico Ciberseguridad EINA UNIZAR, funded by the Spanish National Cybersecurity Institute (INCIBE) and the European Union NextGenerationEU/PRTR, and by grant Programa de Proyectos Estratégicos de Grupos de Investigación (DisCo research group, ref. T21-23R), funded by the University, Industry and Innovation Department of the Aragonese Government.

And that’s all, folks! Stay tuned for our next deep dive into structured memory forensics and how it intersects with adversary behavior modeling. In the meantime, we encourage you to read the full paper at ICDF2C 2025, explore the companion tooling on GitHub, or reach out to us if you’re interested in collaborating on memory forensics methodology, IoC extraction, or MITRE ATT&CK-aligned investigation workflows. Thanks for reading, and stay secure!

Declaration of Generative AI Technologies in the Writing Process

During the preparation of this post, the author used Claude (Claude Opus 4.8 model) to improve readability and language. After using this tool, the author reviewed and edited the content as necessary and takes full responsibility for the content of this publication.