If you can dump the VMs "physical memory" - even from an AWS VM, e.g. using the LiME kernel module (https://github.com/volatilityfoundation/volatility/wiki/Lime

If you can dump the VMs "physical memory" - even from an AWS VM, e.g. using the LiME kernel module (https://github.com/volatilityfoundation/volatility/wiki/Lime-Address-Space https://github.com/volatilityfoundation/volatility/wiki/Lime...) you can still use Volatility and I believe libvmi as well to get some details about what's happening and I don't think it would be possible to disable this technique. Also, this shouldn't interfere with any other guests on the same metal.