AgentAlley

Skills · Security

Memory Forensics

Unverified●24/40

Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add memory-forensics

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

The whole source

No sign-in, no blur, nothing truncated
memory-forensics/SKILL.md348 lines8.2 KBRawView on GitHub
Frontmatter — 2 properties
namememory-forensics
descriptionMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
1---
2name: memory-forensics
3description: Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# Memory Forensics
7 
8Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
9 
10## When to Use This Skill
11 
12- Performing memory analysis during incident response or breach investigation
13- Extracting malware artifacts (processes, injected code, network connections) from a RAM capture
14- Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown
15- Using Volatility 3 / Rekall to triage memory dumps
16- Recovering credentials, browser sessions, or open files from process memory
17 
18## Memory Acquisition
19 
20### Live Acquisition Tools
21 
22#### Windows
23 
24```powershell
25# WinPmem (Recommended)
26winpmem_mini_x64.exe memory.raw
27 
28# DumpIt
29DumpIt.exe
30 
31# Belkasoft RAM Capturer
32# GUI-based, outputs raw format
33 
34# Magnet RAM Capture
35# GUI-based, outputs raw format
36```
37 
38#### Linux
39 
40```bash
41# LiME (Linux Memory Extractor)
42sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
43 
44# /dev/mem (limited, requires permissions)
45sudo dd if=/dev/mem of=memory.raw bs=1MA1 — Writes straight to a block device
46 
47# /proc/kcore (ELF format)
48sudo cp /proc/kcore memory.elf
49```
50 
51#### macOS
52 
53```bash
54# osxpmem
55sudo ./osxpmem -o memory.raw
56 
57# MacQuisition (commercial)
58```
59 
60### Virtual Machine Memory
61 
62```bash
63# VMware: .vmem file is raw memory
64cp vm.vmem memory.raw
65 
66# VirtualBox: Use debug console
67vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf
68 
69# QEMU
70virsh dump <domain> memory.raw --memory-only
71 
72# Hyper-V
73# Checkpoint contains memory state
74```
75 
76## Detailed section: Volatility 3 Framework
77 
78Originally a 2680-byte section in this SKILL.md. Moved to `references/details.md` to fit Codex's 8 KB skill body cap.
79 
80## Analysis Workflows
81 
82### Malware Analysis Workflow
83 
84```bash
85# 1. Initial process survey
86vol -f memory.raw windows.pstree > processes.txt
87vol -f memory.raw windows.pslist > pslist.txt
88 
89# 2. Network connections
90vol -f memory.raw windows.netscan > network.txt
91 
92# 3. Detect injection
93vol -f memory.raw windows.malfind > malfind.txt
94 
95# 4. Analyze suspicious processes
96vol -f memory.raw windows.dlllist --pid <PID>
97vol -f memory.raw windows.handles --pid <PID>
98 
99# 5. Dump suspicious executables
100vol -f memory.raw windows.pslist --pid <PID> --dump
101 
102# 6. Extract strings from dumps
103strings -a pid.<PID>.exe > strings.txt
104 
105# 7. YARA scanning
106vol -f memory.raw windows.yarascan --yara-rules malware.yar
107```
108 
109### Incident Response Workflow
110 
111```bash
112# 1. Timeline of events
113vol -f memory.raw windows.timeliner > timeline.csv
114 
115# 2. User activity
116vol -f memory.raw windows.cmdline
117vol -f memory.raw windows.consoles
118 
119# 3. Persistence mechanisms
120vol -f memory.raw windows.registry.printkey \
121 --key "Software\Microsoft\Windows\CurrentVersion\Run"
122 
123# 4. Services
124vol -f memory.raw windows.svcscan
125 
126# 5. Scheduled tasks
127vol -f memory.raw windows.scheduled_tasks
128 
129# 6. Recent files
130vol -f memory.raw windows.filescan | grep -i "recent"
131```
132 
133## Data Structures
134 
135### Windows Process Structures
136 
137```c
138// EPROCESS (Executive Process)
139typedef struct _EPROCESS {
140 KPROCESS Pcb; // Kernel process block
141 EX_PUSH_LOCK ProcessLock;
142 LARGE_INTEGER CreateTime;
143 LARGE_INTEGER ExitTime;
144 // ...
145 LIST_ENTRY ActiveProcessLinks; // Doubly-linked list
146 ULONG_PTR UniqueProcessId; // PID
147 // ...
148 PEB* Peb; // Process Environment Block
149 // ...
150} EPROCESS;
151 
152// PEB (Process Environment Block)
153typedef struct _PEB {
154 BOOLEAN InheritedAddressSpace;
155 BOOLEAN ReadImageFileExecOptions;
156 BOOLEAN BeingDebugged; // Anti-debug check
157 // ...
158 PVOID ImageBaseAddress; // Base address of executable
159 PPEB_LDR_DATA Ldr; // Loader data (DLL list)
160 PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
161 // ...
162} PEB;
163```
164 
165### VAD (Virtual Address Descriptor)
166 
167```c
168typedef struct _MMVAD {
169 MMVAD_SHORT Core;
170 union {
171 ULONG LongFlags;
172 MMVAD_FLAGS VadFlags;
173 } u;
174 // ...
175 PVOID FirstPrototypePte;
176 PVOID LastContiguousPte;
177 // ...
178 PFILE_OBJECT FileObject;
179} MMVAD;
180 
181// Memory protection flags
182#define PAGE_EXECUTE 0x10
183#define PAGE_EXECUTE_READ 0x20
184#define PAGE_EXECUTE_READWRITE 0x40
185#define PAGE_EXECUTE_WRITECOPY 0x80
186```
187 
188## Detection Patterns
189 
190### Process Injection Indicators
191 
192```python
193# Malfind indicators
194# - PAGE_EXECUTE_READWRITE protection (suspicious)
195# - MZ header in non-image VAD region
196# - Shellcode patterns at allocation start
197 
198# Common injection techniques
199# 1. Classic DLL Injection
200# - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread
201 
202# 2. Process Hollowing
203# - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory
204 
205# 3. APC Injection
206# - QueueUserAPC targeting alertable threads
207 
208# 4. Thread Execution Hijacking
209# - SuspendThread + SetThreadContext + ResumeThread
210```
211 
212### Rootkit Detection
213 
214```bash
215# Compare process lists
216vol -f memory.raw windows.pslist > pslist.txt
217vol -f memory.raw windows.psscan > psscan.txt
218diff pslist.txt psscan.txt # Hidden processes
219 
220# Check for DKOM (Direct Kernel Object Manipulation)
221vol -f memory.raw windows.callbacks
222 
223# Detect hooked functions
224vol -f memory.raw windows.ssdt # System Service Descriptor Table
225 
226# Driver analysis
227vol -f memory.raw windows.driverscan
228vol -f memory.raw windows.driverirp
229```
230 
231### Credential Extraction
232 
233```bash
234# Dump hashes (requires hivelist first)
235vol -f memory.raw windows.hashdump
236 
237# LSA secrets
238vol -f memory.raw windows.lsadump
239 
240# Cached domain credentials
241vol -f memory.raw windows.cachedump
242 
243# Mimikatz-style extraction
244# Requires specific plugins/tools
245```
246 
247## YARA Integration
248 
249### Writing Memory YARA Rules
250 
251```yara
252rule Suspicious_Injection
253{
254 meta:
255 description = "Detects common injection shellcode"
256 
257 strings:
258 // Common shellcode patterns
259 $mz = { 4D 5A }
260 $shellcode1 = { 55 8B EC 83 EC } // Function prologue
261 $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 } // Push hash, call
262 
263 condition:
264 $mz at 0 or any of ($shellcode*)
265}
266 
267rule Cobalt_Strike_Beacon
268{
269 meta:
270 description = "Detects Cobalt Strike beacon in memory"
271 
272 strings:
273 $config = { 00 01 00 01 00 02 }
274 $sleep = "sleeptime"
275 $beacon = "%s (admin)" wide
276 
277 condition:
278 2 of them
279}
280```
281 
282### Scanning Memory
283 
284```bash
285# Scan all process memory
286vol -f memory.raw windows.yarascan --yara-rules rules.yar
287 
288# Scan specific process
289vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234
290 
291# Scan kernel memory
292vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel
293```
294 
295## String Analysis
296 
297### Extracting Strings
298 
299```bash
300# Basic string extraction
301strings -a memory.raw > all_strings.txt
302 
303# Unicode strings
304strings -el memory.raw >> all_strings.txt
305 
306# Targeted extraction from process dump
307vol -f memory.raw windows.memmap --pid 1234 --dump
308strings -a pid.1234.dmp > process_strings.txt
309 
310# Pattern matching
311grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt
312```
313 
314### FLOSS for Obfuscated Strings
315 
316```bash
317# FLOSS extracts obfuscated strings
318floss malware.exe > floss_output.txt
319 
320# From memory dump
321floss pid.1234.dmp
322```
323 
324## Best Practices
325 
326### Acquisition Best Practices
327 
3281. **Minimize footprint**: Use lightweight acquisition tools
3292. **Document everything**: Record time, tool, and hash of capture
3303. **Verify integrity**: Hash memory dump immediately after capture
3314. **Chain of custody**: Maintain proper forensic handling
332 
333### Analysis Best Practices
334 
3351. **Start broad**: Get overview before deep diving
3362. **Cross-reference**: Use multiple plugins for same data
3373. **Timeline correlation**: Correlate memory findings with disk/network
3384. **Document findings**: Keep detailed notes and screenshots
3395. **Validate results**: Verify findings through multiple methods
340 
341### Common Pitfalls
342 
343- **Stale data**: Memory is volatile, analyze promptly
344- **Incomplete dumps**: Verify dump size matches expected RAM
345- **Symbol issues**: Ensure correct symbol files for OS version
346- **Smear**: Memory may change during acquisition
347- **Encryption**: Some data may be encrypted in memory
348 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Security
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.Security · MIT◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.Security · MIT◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.Security · MIT◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.Security · MIT◐◐◐◐◐●30/40