Volatile memory captures

Name: Volatile memory captures
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects volatile memory capture records and analysis output: memory-capture wording with capture metadata, memory image file names, Volatility plugin output and addresses. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated capture field (host, image file/path, profile, acquisition tool/time, OS build, KDBG/DTB, PID) or a memory artefact (.raw/.mem/.vmem/.dmp/.lime file, Volatility plugin output name, hex address)), and 85 needs two distinct structures plus independent memory-forensics (Volatility/WinPmem/DumpIt/LiME, credential extraction) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), GDPR
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:memory\s+(?:dump|capture|image|acquisition)s?|volatile\s+memory|RAM\s+(?:capture|dump|image)|hiberfil\.sys|crash\s+dump|lsass\s+dump)\b

Corroborative evidence keywords

Volatility, WinPmem, DumpIt, LiME, Magnet RAM Capture, NTLM hash, Mimikatz, process list, injected code, encryption keys

Proximity: 300 characters

Should match

Incident responders took a memory capture before powering off the server. — Discovery probe (65)
Memory capture record Hostname: ws-fin-114 Image file: ws-fin-114_20260912.raw — Medium-tier probe (75) - capture fields and image file
Memory capture record - IR-2026-114 Hostname: ws-fin-114 Acquisition tool: WinPmem 4.0 Acquisition time: 2026-09-12 04:02 Image file: ws-fin-114_20260912.raw Volatility windows.malfind flagged injected code in PID 4312 at 0x7ff6a2c10000; Mimikatz strings present. — High-tier probe (85) - several capture fields, image file, plugin output, tooling context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: responders should capture volatile memory before shutting down a compromised host. — Policy text
Memory capture record template Hostname: ________ Image file: [insert] — Blank template
Webinar notes: using Volatility on a memory dump - run windows.pslist against memory.raw. — Webinar/training framing

Known false positives

Application crash-dump settings and developer debugging guides. Mitigation: Enforcement needs capture metadata or memory artefacts; 85 also needs memory-forensics tooling context; guidance framing is excluded.