Анализ heap spray атак в дампах памяти

★ 8.4 · security

analyzing-heap-spray-exploitation is a Claude Code skill that detects and analyzes heap spray attacks in memory dumps using Volatility3 plugins. It follows four structured steps: scanning processes with windows.malfind for executable injected memory regions, examining VAD tree entries via windows.vadinfo for large contiguous allocations with RWX permissions, searching suspicious regions for NOP sled patterns (0x90 sequences and 0x0c0c0c0c), and dumping memory to extract embedded shellcode for byte-pattern analysis. Output is a JSON report covering suspicious processes, heap spray indicators, NOP sled locations, memory region sizes, and extracted shellcode hashes. The skill targets SOC analysts, malware researchers, and threat hunters who need a repeatable memory forensics procedure when investigating exploitation attempts linked to MITRE ATT&CK techniques T1203, T1059.007, and T1106.