From 47219aad67283653b482eccb69d18b6aa8300748 Mon Sep 17 00:00:00 2001
From: blitztide <david.elliott3040@gmail.com>
Date: Fri, 29 Aug 2025 03:06:23 +0100
Subject: [PATCH 1/2] Feature: vadyarascan enrichment This add contextual data
 to each hit with vadyarascan, saves running pslist after processing. Original
 didn't have imagename or PPID

---
 .../framework/plugins/windows/vadyarascan.py      | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py
index 04b9aadd9..452a2f774 100644
--- a/volatility3/framework/plugins/windows/vadyarascan.py
+++ b/volatility3/framework/plugins/windows/vadyarascan.py
@@ -4,6 +4,7 @@
 
 import logging
 from typing import Iterable, List, Tuple
+import datetime
 
 from volatility3.framework import interfaces, renderers
 from volatility3.framework.configuration import requirements
@@ -102,6 +103,15 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
                     yield 0, (
                         format_hints.Hex(offset),
                         task.UniqueProcessId,
+                        task.get_create_time(),
+                        task.InheritedFromUniqueProcessId,
+                        task.ImageFileName.cast(
+                            "string",
+                            max_length=task.ImageFileName.vol.count,
+                            errors="replace",
+                        ),
+                        task.get_session_id(),
+                        task.ActiveThreads,
                         rule_name,
                         name,
                         layer_data,
@@ -130,6 +140,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
             [
                 ("Offset", format_hints.Hex),
                 ("PID", int),
+                ("CreateTime", datetime.datetime),
+                ("PPID", int),
+                ("ImageFileName", str),
+                ("SessionId", int),
+                ("Threads", int),
                 ("Rule", str),
                 ("Component", str),
                 ("Value", renderers.LayerData),

From d6a791cb675574c6cc35d68cf2e6932f6fe525ce Mon Sep 17 00:00:00 2001
From: blitztide <david.elliott3040@gmail.com>
Date: Thu, 4 Sep 2025 22:39:46 +0100
Subject: [PATCH 2/2] VadYaraScan: Increment version

---
 volatility3/framework/plugins/windows/vadyarascan.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py
index 452a2f774..bbbe49f2d 100644
--- a/volatility3/framework/plugins/windows/vadyarascan.py
+++ b/volatility3/framework/plugins/windows/vadyarascan.py
@@ -19,7 +19,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface):
     """Scans all the Virtual Address Descriptor memory maps using yara."""
 
     _required_framework_version = (2, 22, 0)
-    _version = (1, 1, 3)
+    _version = (1, 1, 4)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: