One powerful tool that analysts should include in their toolkits is Mandiant Redline. This Microsoft Windows application provides a feature rich platform for analyzing memory images. These features include the ability to create a memory collector, although the tool will work with memory captures that have been performed via tools previously discussed. There is also the ability to utilize previously discovered Indicators of Compromise (IOCs) to aid in the examination. The tool can be downloaded at fireeye.com/MandiantRedline/FireEyeRedline.
The download package includes a Microsoft Self Installer:
- Once installed, double-click on the icon and the following screen will appear. There are a number of options broken out into two categories: ...
