Digital › Module 5 › Lesson 2
Process Artifacts
Process artifacts name PID, PPID, cmdline, DLLs, and handles in RAM — interpret on YOUR $DFIR_LAB dumps without tampering.
Visual · t26_process_artifacts
Process artifact literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Malware hides in process trees — literacy reads parent/child, path, and command line before disk corroboration.
Process listings show executable path, process ID, parent ID, start time, and command-line arguments (when preserved). DLL lists reveal injected libraries. Handle tables show open files and mutants — advanced literacy. Compare memory process list to disk autostart — discrepancies warrant deeper review. Cyberlium documents process artifact fields on YOUR $DFIR_LAB — label course malware samples as lab — never fabricate process trees on unauthorized captures. Next: Memory Order.
1. Key process fields (named)
PID/PPID: parent-child relationships expose spawn chains. Image path: legit path vs temp folder. Cmdline: arguments revealing encoded payloads or admin tools — handle sensitive data carefully in notes.
On $DFIR_LAB dump, document one benign and one lab-malicious process row — fictional names OK if course-labeled.
Command guide
Try these commands — Key process fields (named)
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, grep. Reference sites: Volatility 3 (https://github.com/volatilityfoundation/volatility3); Volatility docs (https://volatility3.readthedocs.io/en/latest/); SANS memory forensics (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Corroboration habit
Memory-only process with no disk backing may indicate injection or transient loader — hypothesis, not automatic guilt. Pair with disk timeline, net connections, and logs.
Reports cite plugin name, UTC time, and exhibit ID — reproducibility matters.
3. Ethics in artifact reporting
Forbidden: inventing cmdline evidence, editing dump bytes, or exfiltrating live credentials from practice dumps to chat. Allowed: process artifact glossary — five fields with defender meaning.
Ship: process artifact glossary tied to $DFIR_LAB example row. Next: Memory Order.
4. What you ship: process artifact glossary for $DFIR_LAB
Five fields with meanings, one example row. $DFIR_LAB named. NEVER fabricate artifacts. chmod 600.
5. What you record before the next lesson
Date. Process glossary. $DFIR_LAB named. File t26-m05-l02-process-artifacts.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fabricate cmdline proving a narrative. Share credential strings from dumps publicly.
Right
Write process artifact glossary for YOUR $DFIR_LAB dump. Next: Memory Order.
Mission: read one process row in YOUR lab
1) Define PID and PPID. 2) Explain why cmdline matters. 3) Note one corroboration source (disk/log). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Parent spawned from unexpected path is a classic triage cue.
Knowledge Check
APPLY: Process artifacts in memory include:
Multiple choice
Knowledge Check
APPLY: True or False: Memory process lists should be corroborated with disk or logs when possible.
True or False
Knowledge Check
APPLY: Fabricating process evidence is:
Multiple choice