We (the Volatility team) are often asked about what the memory forensics R&D process looks like, and how the abuse of an API by malware or a new code injection technique can be successfully uncovered by a Volatility plugin. To illustrate this process, we just published a blog post that takes you from analyzing a potent target - the Skeleton Key attack of Mimikatz - through developing a new Volatility 3 plugin that can automatically detect it: https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated… Feedback and comments are greatly appreciated. We hope you enjoy the post!