Which Volatility plug-in is commonly used to identify processes that may be hidden from standard process listings?

Which Volatility plug-in is commonly used to identify processes that may be hidden from standard process listings?

• A. psList
• B. psScan
• C. malfind
• D. dlllist

Answer: (B)

Hidden processes can stay out of the standard process listing if malware unlinks itself from the OS’s process table. psScan addresses this by scanning memory for kernel-mode process structures (EPROCESS) and reconstructing a complete set of processes, independent of the OS-visible list. It then flags any EPROCESS structures that don’t match the processes shown in the regular listing, revealing those hidden by rootkits or tampering. This differs from psList, which relies on the OS’s ActiveProcessLinks and can miss hidden processes. malfind focuses on detecting injected code and suspicious memory artifacts, not identifying hidden processes. dlllist enumerates DLLs loaded into a known process, which helps with injection analysis but not with uncovering processes that are hidden from the normal view. So psScan is the go-to tool for uncovering processes that may be concealed from standard process listings.

Hidden processes can stay out of the standard process listing if malware unlinks itself from the OS’s process table. psScan addresses this by scanning memory for kernel-mode process structures (EPROCESS) and reconstructing a complete set of processes, independent of the OS-visible list. It then flags any EPROCESS structures that don’t match the processes shown in the regular listing, revealing those hidden by rootkits or tampering.

This differs from psList, which relies on the OS’s ActiveProcessLinks and can miss hidden processes. malfind focuses on detecting injected code and suspicious memory artifacts, not identifying hidden processes. dlllist enumerates DLLs loaded into a known process, which helps with injection analysis but not with uncovering processes that are hidden from the normal view.

So psScan is the go-to tool for uncovering processes that may be concealed from standard process listings.