Ghosts in the RAM: A Field Guide to Memory Forensics

One hunt, two altitudes — from a process-level intrusion down into a kernel rootkit