LiME内存取证分析
原名：analyzing-memory-forensics-with-lime-and-volatility
使用LiME（Linux内存提取器）执行Linux内存获取。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-19
- TRACE 评分
- 3.4 / 5
内容概览
- When investigating security incidents that require analyzing memory forensics with lime and volatility - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Familiarity with security operations concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities Acquire Linux memory using LiME kernel module, then analyze with Volatility 3 to extract forensic artifacts from the memory image. Key analysis steps: 1. Acquire memory with LiME (format=lime or format=raw) 2. List processes with linux.pslist, compare with linux.psscan 3. Extract bash command history with linux.bash 4. List network connections with li…