---
title: "Guest memory inspection · Ataris"
description: "On demand, for a flagged microVM, Ataris reads the guest's memory from the host and lists its processes, binaries, and open connections as evidence for the case."
canonical: "https://ataris.dev/product/memory-inspection"
last-updated: 2026-11-02
---
# See inside a flagged microVM, without an agent in it.

On demand, for a flagged microVM, Ataris reads the guest's memory from the host and lists its processes, binaries, and open connections as evidence for the case.

## Evidence from inside, collected from outside.

Host signals say a VM is mining. A reviewer wants to see the miner. Memory inspection gives them the process list without installing anything in the guest.

### 1. Flag: Start from a case.

Inspection runs on demand, for a microVM that already has a case. It is not continuous monitoring.

Example (CASE #0417): vm = vm-3f1c; runtime = firecracker; reason = mining, scanning.

### 2. Read: Read the guest from the host.

Ataris reads the guest's memory from the host and reconstructs what was running: processes, the binaries behind them, and open connections.

Example (vm-3f1c · snapshot): pid 412 = xmrig; pid 418 = masscan; pid 77 = sshd; conn = → 203.0.113.7:3333.

### 3. Attach: Attach it to the case.

The snapshot is saved with the case, so the reviewer, and anyone who audits the decision later, sees the same evidence.

Example (CASE #0417 · evidence): host signals = attached; memory snapshot = attached; account context = attached.

## What a snapshot shows.

Enough to name what was running, read from the host.

- **Processes.** What was running. process names, PIDs, parent and child.
- **Binaries.** What they were. executable names, paths.
- **Connections.** Who they talked to. open sockets, remote addresses, ports.

## Related

- [Case queue](https://ataris.dev/product/case-queue.md): Ranked, evidence-backed, report-only
- [Cryptomining](https://ataris.dev/use-cases/cryptomining.md): Miners on free and paid accounts
- [Abuse detection](https://ataris.dev/product/abuse-detection.md): Mining, scanning, spam, farmed free tiers

## Put the miner's name in the case.

Book a demo and we'll show a memory snapshot on a flagged microVM.

[Book a demo](https://ataris.dev/contact)