Leveraging AI for Behavioural Analysis of Digital Forensic Artifacts in Cybercrime Investigations
Abstract
In memory execution, OS tools (for example, PowerShell, WMI), and registry manipulation are widely leveraged by fileless malware, which makes it very difficult to detect with the traditional forensic tools. This chapter studies memory forensics as a primary method to trace down attacks such as this one, concentrating on the volatile memory (RAM) analysis. They talk about attack types such as code injection, LOLBins and reflectively loaded DLLs, to name a few, and a few tools such as Cobalt Strike and Empire. Volatility, FTK Imager and YARA rules are leveraged to generate artifacts such as executable injected code, network sockets and command history. In the chapter, find out how we map the findings to the cyber kill chain, and what makes RAM analysis a must for detection, response, and proactive hunting.
Fields of Study & Subjects
Digital and Cyber Forensics
Advanced Malware Detection Techniques
Security and Verification in Computing
Publication details
- Journal / source
- Cyber Forensic Frameworks for User-Centric Human Threat Intelligence Analysis
- Publisher
- IGI Global Scientific Publishing
- Pages
- 375–402
- Publication date
- 30 January 2026
- Language
- NG
- Document type
- Book chapter