From e64af61efa1a37f6d5c91e34d5375219b1544ee3 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Sun, 29 Dec 2024 02:13:18 +0000
Subject: [PATCH] Do not analyze processes without VADs #1470

---
 volatility3/framework/plugins/windows/direct_system_calls.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py
index b0c162f46..183e4095c 100644
--- a/volatility3/framework/plugins/windows/direct_system_calls.py
+++ b/volatility3/framework/plugins/windows/direct_system_calls.py
@@ -433,6 +433,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface):
             proc_layer = self.context.layers[proc_layer_name]
 
             vads = self.get_vad_maps(proc)
+            if not vads:
+                continue
 
             # for each valid process, look for malicious syscall invocations
             for address, vad_path in self._get_rule_hits(