extracting-memory-artifacts-with-rekall

name	extracting-memory-artifacts-with-rekall
description	Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
domain	cybersecurity
subdomain	security-operations
tags	["memory-forensics","rekall","process-hollowing","code-injection","vad-analysis","incident-response","security-operations"]
version	1.0
author	mahipal
license