# Baseliner

## baseliner.py\#

{% embed url="https://www.sans.org/blog/power-up-memory-forensics-with-memory-baseliner/" %}

[https://github.com/csababarta/memory-baseliner](https://github.com/csababarta/memory-baseliner)

Uses a baseline image to check for malicious processes - Easy, quick wins&#x20;

```python
python3 /opt/memory-baseliner/baseline.py -proc -i rd01-memory.img  --loadbaseline --jsonbaseline /cases/memory/baseline/Win11x64_proc_baseline.json -o proc_baseline.csv
# convert to CSV 
sed -i 's/|/,/g' proc_baseline.csv

```

