VolGetProcWithMalNetConn

Volatility script for getting the list of processes that have connections to ip address with bad reputation.

Details

ID	`VolGetProcWithMalNetConn`
Language	javascript
From Version	5.0.0
Tags	memory forensics volatility server

README

Gets the list of processes that have connections to IP addresses with a bad reputation.

Script Data

Name	Description
Script Type	javascript
Tags	memory, forensics, volatility, server

Inputs

Argument Name	Description
memdump	The path to memory dump the file on the system being used.
system	The system with Volatility installed to be used for the analysis.
profile	The Volatility profile to use.
repthreshold	The reputation threshold. Any IP addresses up to and including this score are considered malicious.
repscript	The reputation script to use to check IP addresses.

Outputs

There are no outputs for this script.

Source

VolGetProcWithMalNetConn.js VolGetProcWithMalNetConn.yml

Download History Raw

commonfields:
  id: VolGetProcWithMalNetConn
  version: -1
name: VolGetProcWithMalNetConn
script: ''
type: javascript
tags:
- memory
- forensics
- volatility
- server
comment: Volatility script for getting the list of processes that have connections
  to ip address with bad reputation.
system: true
args:
- name: memdump
  required: true
  description: Path to memory dump file on the system being used
- name: system
  required: true
  description: System with Volatility installed to be used for the analysis
- name: profile
  required: true
  description: Volatility profile to use
- name: repthreshold
  description: Reputation threshold - any IP addresses up to and including this score
    are considered malicious
- name: repscript
  description: Reputation script to use for checking IP addresses
scripttarget: 0
dependson: {}
timeout: 0s
fromversion: 5.0.0