Using Volatility 3 to Detect Sophisticated Malware
Andrew Case
BSides NYC 2025 (0x05) · Day 1 · Tech - Blue
In this insightful talk from BSides NYC, Andrew Case, Director of Research at Vexity and a core developer of the Volatility memory forensics framework, delved into the critical role of **memory forensics** in detecting highly sophisticated malware. The presentation highlighted how modern, advanced persistent threats (APTs) and criminal ransomware groups increasingly employ "memory-only" techniques, allowing their payloads to execute without ever touching disk. This evasion strategy renders traditional endpoint detection and response (EDR) solutions and disk-based forensics largely ineffective, leaving organizations blind to active infections.
AI review
Andrew Case is the right person to give this talk — core Volatility dev with real IR cases behind the techniques — and the content delivers where it counts: VAD-based detection logic, the `PAGE_EXECUTE_WRITECOPY` invariant, process ghosting, and the `suspicious.threads` approach to PE-header-overwrite bypass are all explained with enough precision to be operationally useful. BSides NYC, not Black Hat main stage, which calibrates expectations appropriately; this is a practitioner talk, not a research paper drop, but it's a good one.