| 1 | --- |
| 2 | title: "Volatility 3 Malware Hunting (Full Tutorial)" |
| 3 | description: Memory-forensics workflow for malware hunting using Volatility 3. |
| 4 | --- |
| 5 | |
| 6 | **Video:** https://www.youtube.com/watch?v=R1X8V9yy_Y4 |
| 7 | |
| 8 | ## Goal |
| 9 | Use Volatility 3 to hunt malware and suspicious activity in memory dumps. |
| 10 | |
| 11 | ## When to use |
| 12 | - When you have a memory capture from a suspicious host |
| 13 | - When you need deeper insight than disk/EDR telemetry provides |
| 14 | |
| 15 | ## Prereqs |
| 16 | - Memory dump acquired and stored securely |
| 17 | - Volatility 3 available in your analysis environment |
| 18 | |
| 19 | ## Procedure (high level) |
| 20 | 1) Identify profile/context and validate the dump |
| 21 | 2) Enumerate processes and suspicious artifacts |
| 22 | 3) Pivot into network, modules, command lines, and persistence indicators |
| 23 | 4) Document findings and feed back into detections |
| 24 | |
| 25 | ## Validation |
| 26 | - Findings are reproducible and mapped to concrete evidence |