In memory forensics with Volatility, what does the pslist plugin reveal?

• A. It lists DLLs loaded by each process.
• B. It extracts network connections.
• C. It lists running processes as captured in the memory image, aiding detection of hidden or injected processes.
• D. It dumps memory regions to files.

Answer: (C)

The main idea is that pslist reads the in-memory process list from the Windows memory image to show processes exactly as the OS believes them to be, based on the in-memory EPROCESS structures. By walking those kernel-linked process blocks, pslist outputs each process’s name, process ID, parent process ID, and other session-related details as they exist in memory at the time the image was captured.

This is powerful for detection because it can reveal processes that might not be visible through standard OS tooling or file-system views, such as hidden or injected processes associated with rootkits or process hollowing. If a process is running in memory but its presence isn’t reflected in normal system listings, pslist helps you spot that discrepancy and investigate further.

It’s worth noting what pslist is not doing here: it isn’t listing DLLs loaded by processes (that’s a different plugin), it isn’t extracting live network connections, and it isn’t dumping memory regions to files. Those other tasks require otherVolatility plugins.