agentsclimarketplace

Detecting process injection in memory

Skill meltedinhex/analyst-ai-pack/skills/detecting-process-injection-in-memory

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill detecting-process-injection-in-memory

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Detecting Process Injection in Memory

When to Use

  • You have a Windows memory image and want to find injected/hollowed code.
  • You are triaging private RWX regions, unbacked executable memory, and PE headers in private allocations (classic injection/hollowing signs).

Do not use this on a live production host without authorization — work from an acquired image. This skill interprets analysis output; run Volatility separately on the image.

Prerequisites

  • A memory image and Volatility 3 (windows.malfind, windows.vadinfo) installed.

Safety & Handling

  • Treat carved injected regions as live malicious code; store them password-protected.

Workflow

Step 1: Run malfind and capture output

vol -f memory.raw windows.malfind > malfind.txt

Step 2: Score injection candidates

python scripts/analyst.py score malfind.txt

Flags regions with PAGE_EXECUTE_READWRITE, MZ/PE headers in private memory, and shellcode-like disassembly hints, ranking processes by suspicion.

Step 3: Corroborate

Cross-check flagged PIDs with windows.vadinfo (private, executable, no mapped file) and the process tree for anomalous parents.

Step 4: Carve and route

Carve the injected region for follow-on shellcode/PE recovery and analysis.

Validation

  • Flagged regions are private + executable, not legitimate mapped images.
  • PE-in-private-memory findings are confirmed by an MZ/This program signature.
  • High-scoring PIDs corroborate with VAD protections and process-tree anomalies.

Pitfalls

  • JIT engines (.NET, Java, browsers) legitimately create RWX regions — corroborate before alerting.
  • Relying on malfind alone; pair with vadinfo and ldrmodules.
  • Missing hollowing where the region is RX (not RWX) after protection change.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.