📂 02 - D3FEND Process
Overview
Running processes and their memory, usually examined through a memory dump or VM snapshot. D3FEND has no dedicated “memory dump” artifact, so memory forensics lives here: rebuilding the process list, command lines, loaded modules, and secrets held in process memory.
D3FEND artifact: Process
🧠 Techniques
| File | Created |
|---|---|
| Memory Forensics - Windows Credential Extraction from VM Snapshots | September 06, 2026 |
📦 Tech Stack
| File | Created |
|---|
🛠️ Tools
| File | Created |
|---|---|
| Volatility 3 | September 06, 2026 |
🚩 Related CTF Operations
| File | difficulty |
|---|