processes‑memory Audit

Collects a list of running processes of Windows host endpoints with comprehensive information about imported modules, sections, and other data gathered from advanced memory-scanning techniques.

This audit may return more information than expected if run against all processes. Specifying a process ID is recommended.

This audit was formerly known as the w32processes-memory audit.

Supported Platforms

Windows only

Memory-related audits are now supported for host endpoints running the following Windows operating system versions.

Windows 7 (32-bit & 64-bit)
Windows Server 2012 R2 (64-bit)
Windows Server 2016 (64-bit)
Windows Server 2019 (64-bit)
Windows Server 2022 (64-bit)
Windows 8.1 (32-bit & 64-bit)
Windows 10 2015 LTSB, 2016 LTSB, 2019 LTSC
Windows 10 RS1 - 21H2 (64-bit)
Windows 11 21H2 (64-bit)

Input Parameters

The following input parameters are available for this audit.

pid

Details	Values	Description
Platform	Windows	Windows environments
Format	PID	Valid values are a process ID.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the process ID that the audit should analyze. This parameter cannot be specified in conjunction with the `process name` parameter.

process name

Details	Values	Description
Platform	Windows	Windows environments
Format	String	Valid values are a string of text.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		This parameter cannot be specified in conjunction with the `pid` parameter.

handles

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should parse the process handles.

sections

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should parse the process memory sections.

ports

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should parse the process for open ports.

enumerate imports

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should enumerate imports of all loaded modules for a given process.

enumerate exports

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should enumerate exports of all loaded modules for a given process.

Content Regex

Details	Values	Description
Platform	Windows	Windows environments
Format	ArrayOfString	Valid values are specified in an array of string values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify a valid regex string for which to search.

Preserve Times

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the last access times for audited files should be manually reset.

MemD5

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should compute the MD5 hash for each file returned from memory.

MD5

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether an MD5 hash should be computed for each returned file.

SHA1

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether an SHA1 hash should be computed for each returned file.

SHA256

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether an SHA256 hash should be computed for each returned file.

Verify Digital Signatures

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should verify that the loaded modules within the processes address space are digitally signed. This operation cannot be performed on a memory image.

raw mode

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to open files for hashing in raw mode.

detect injected dlls

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the audit should detect injected DLLs.

strings

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to parse specified files for strings. If this parameter is enabled, the default string length is 4 bytes (see the `shortest matched string` parameter).

shortest matched string

Details	Values	Description
Platform	Windows	Windows environments
Format	Numeric	Valid values are numeric.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the minimum recognized string length.

memory file

Details	Values	Description
Platform	Windows	Windows environments
Format	FilePath	Valid values are a full file path and file name.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the full path and file name of the file that represents the host endpoint's physical memory.

Prevent Hibernation

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed.