Stripe: Automated In Memory Forensics
summary
Stripe builds an OSquery extension that exposes a proc_dump table to perform targeted in‑memory process dumps triggered by SIEM signals like GetAsyncKeyState or nonstandard Cocoa screenshot calls. The system routes a fleet manager query to the endpoint, returns real-time memory dumps, and lets analysts dissect credential theft or coinwallet stealers while the attack is active. Prototype scales across fleets, proves fast enough for live triage, and is not yet publicly released.
AI-written summary · about
related talks
56mAnatomy of memory scraping credit card stealing POS malware
50mDynamic Analysis of MacOS Malware Using SpriteTree
20mLeveraging Osquery for DFIR at Scale
59mA Journey to Protect Points-of-Sale
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
32mA Case Study of MacOS Supply Chain Compromise
11mCache Me If You Can: Modern IOS Spyware and the Vanishing Forensic Trail
33mMemory Forensics Using Virtual Machine Introspection for Cloud Computing