Injected payload memory forensics

Hello All,

I was working on an interesting case for a compromised server, i investigated the disk but didn't find any artifacts for the compromise.However, by doing deep memory forensics, i was able to detect a payload injected into a process, mostly a beacon. Now, I am thinking how could i know the root cause of the compromise without any disk forensics, and only by the detected memory payload

artifacts beacon blueteamsec case compromise compromised detect disk doing find forensics hello memory memory forensics payload process root server thinking working