Exam 312-49v10 topic 1 question 653 discussion

ECCouncil Official CHFI https://bookshelf.vitalsource.com/reader/books/9781635676969/ Module 07 Page 760 "Detecting hidden files in memory using malfind plugin Running the malfind plugin helps forensic investigators detect hidden or injected files, which are generally dynamic-link library (DLL) files, in the memory. If the output from the pstree plugin indicates that a particular PID is suspicious, investigators should run the malfind plugin on that PID to determine its legitimacy." ----- If you agree: UPVOTE this post to add your vote to the community tally. If you disagree: discuss with citations Both actions crowdsource best answers.

CHFIv11 page 515: "malfind...hidden processes or injected code/DLLs..."

The malfind plugin is used to identify hidden processes or injected code/DLLs in user mode memory

A < https://code.google.com/archive/p/volatility/wikis/CommandReferenceMal22.wiki#:~:text=The%20malfind%20command%20helps%20find,process%20using%20CreateRemoteThread%2D%3ELoadLibrary.