Memory Forensics: Find the Process That Does Not Belong
intermediate Hands-on lab 55 min 3 tasksSubscription
Read the reports a memory-forensics tool produced from a compromised workstation and find the process the attacker took over, using its parent, its command line, injected code and its connections.
This lab is available with a Purple Edge subscription. Sign in to view the full overview and start the lab.
Part of these paths
Unlock this lab
Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.
Updated 2026-11-01