Detecting Masqueraded Windows Processes in Volatile Memory: A Rule-Based Detection Framework and Weighted Scoring Model

Volatility 3 reconstructs process state from a memory image but does not, by itself, provide the higher-level contextual judgement required to determine whether a reconstructed process is anomalous. An analyst reading windows.pslist output sees a flat table in which a masqueraded svchost.exe running from C:\ is visually identical to legitimate instances in C:32\ — the distinguishing evidence is present but is not surfaced as a signal. Recent work automating this triage step is driven by large language models, introducing non-determinism into a forensic workflow. This paper presents ProcSentinel, a deterministic alternative: a publicly available engine applying inspectable declarative rules over Volatility 3 output, encoding expected Windows invariants — canonical binary locations, legitimate parent-child relationships, PE metadata expectations — with a scoring model that separates per-finding severity from case-level aggregation. I specify the rule framework and formalise the scoring model, then trace it end to end over the demonstration finding set bundled with the tool. This paper reports no detection evaluation; establishing detection performance is stated as required future work.