memory_run_plugin
Execute forensic analysis plugins against a memory image to uncover processes, network artifacts, or hidden code. Filter results and supply custom plugin parameters.
Instructions
Run a forensics plugin. Tier 1 (Rust, fast): pslist, psscan, cmdline, dlllist, malfind, netscan, cmdscan, search, readraw, rsds — use short names. Tier 3 (Vol3): any other plugin — short names auto-resolve (e.g. 'filescan', 'handles', 'envars'). If a short name fails, use full Vol3 path: 'windows.category.PluginName' (e.g. 'windows.mftscan.MFTScan'). Use 'filter' param to grep results server-side (avoids truncation). For search: use params={"pattern": "text", "encoding": "ascii|utf16le|hex", "limit": N, "context": N}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pid | No | Filter by PID | |
| filter | No | Case-insensitive substring filter applied to results before returning. Useful for large result sets like filescan. | |
| params | No | Additional plugin parameters | |
| plugin | Yes | Plugin name (e.g., 'pslist', 'malfind', 'filescan') | |
| image_path | Yes | Path to memory dump file |