[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFXB0RTVGG0AZF1WFN81ZW":3,"skill-same:01M6AFXB0RTVGG0AZF1WFN81ZW":130},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AFXB0RTVGG0AZF1WFN81ZW","performing-memory-forensics-with-volatility3-plugins",null,"Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing memory forensics with volatility3 plugins","memory","plugins","forensics","volatility3","memory-forensics","rootkit-detection","analysis","injection","execution","t1003","process-injection","dfir","macos","rootkit","malware","code","windows","cybersecurity","linux","2026-11-10 10:12:30",false,"---\nname: performing-memory-forensics-with-volatility3-plugins\ndescription: Analyze memory dumps using Volatility3 plugins to detect injected code,\n  rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory\n  images.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- memory-forensics\n- volatility3\n- malware-analysis\n- incident-response\n- process-injection\n- rootkit-detection\n- dfir\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmitre_attack:\n- T1027\n- T1055\n- T1140\n- T1497\n- T1003\n---\n# Performing Memory Forensics with Volatility3 Plugins\n\n## Overview\n\nVolatility3 (v2.26.0+, feature parity release May 2025) is the standard framework for memory forensics, replacing the deprecated Volatility2. It analyzes RAM dumps from Windows, Linux, and macOS to detect malicious processes, code injection, rootkits, credential harvesting, and network connections that disk-based forensics cannot reveal. Key plugins include `windows.malfind` (detecting RWX memory regions indicating injection), `windows.psscan` (finding hidden processes), `windows.dlllist` (enumerating loaded modules), `windows.netscan` (active network connections), and `windows.handles` (open file\u002Fregistry handles). The 2024 Plugin Contest introduced ETW Scan for extracting Event Tracing for Windows data from memory.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing memory forensics with volatility3 plugins\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `volatility3` framework installed\n- Memory dump files (`.raw`, `.dmp`, `.vmem`, `.lime`)\n- Windows symbol tables (ISF files, auto-downloaded)\n- Understanding of Windows process memory architecture\n- YARA integration for in-memory pattern scanning\n\n## Workflow\n\n### Step 1: Process Analysis for Malware Detection\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Volatility3-based memory forensics automation for malware analysis.\"\"\"\nimport subprocess\nimport json\nimport sys\nimport os\n\n\nclass Vol3Analyzer:\n    \"\"\"Automate Volatility3 plugin execution for malware analysis.\"\"\"\n\n    def __init__(self, dump_path, vol3_path=\"vol\"):\n        self.dump_path = dump_path\n        self.vol3 = vol3_path\n        self.results = {}\n\n    def run_plugin(self, plugin, extra_args=None):\n        \"\"\"Execute a Volatility3 plugin and capture output.\"\"\"\n        cmd = [\n            self.vol3, \"-f\", self.dump_path,\n            \"-r\", \"json\", plugin,\n        ]\n        if extra_args:\n            cmd.extend(extra_args)\n\n        try:\n            result = subprocess.run(\n                cmd, capture_output=True, text=True, timeout=300\n            )\n            if result.returncode == 0:\n                return json.loads(result.stdout)\n        except (subprocess.TimeoutExpired, json.JSONDecodeError) as e:\n            print(f\"  [!] {plugin} failed: {e}\")\n        return None\n\n    def detect_process_injection(self):\n        \"\"\"Use malfind to detect injected code regions.\"\"\"\n        print(\"[+] Running windows.malfind (code injection detection)\")\n        results = self.run_plugin(\"windows.malfind\")\n\n        injected = []\n        if results:\n            for entry in results:\n                injected.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"address\": entry.get(\"Start VPN\"),\n                    \"protection\": entry.get(\"Protection\"),\n                    \"hexdump\": entry.get(\"Hexdump\", \"\")[:200],\n                })\n                print(f\"  [!] Injection in PID {entry.get('PID')} \"\n                      f\"({entry.get('Process')}) at {entry.get('Start VPN')}\")\n\n        self.results[\"injected_processes\"] = injected\n        return injected\n\n    def find_hidden_processes(self):\n        \"\"\"Compare pslist vs psscan to find hidden processes.\"\"\"\n        print(\"[+] Running process comparison (pslist vs psscan)\")\n\n        pslist = self.run_plugin(\"windows.pslist\")\n        psscan = self.run_plugin(\"windows.psscan\")\n\n        if not pslist or not psscan:\n            return []\n\n        list_pids = {e.get(\"PID\") for e in pslist}\n        scan_pids = {e.get(\"PID\") for e in psscan}\n\n        hidden = scan_pids - list_pids\n        if hidden:\n            print(f\"  [!] {len(hidden)} hidden processes found!\")\n            for entry in psscan:\n                if entry.get(\"PID\") in hidden:\n                    print(f\"    PID {entry['PID']}: {entry.get('ImageFileName')}\")\n\n        self.results[\"hidden_processes\"] = list(hidden)\n        return list(hidden)\n\n    def analyze_network(self):\n        \"\"\"Extract active network connections.\"\"\"\n        print(\"[+] Running windows.netscan\")\n        results = self.run_plugin(\"windows.netscan\")\n\n        connections = []\n        if results:\n            for entry in results:\n                conn = {\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Owner\"),\n                    \"local\": f\"{entry.get('LocalAddr')}:{entry.get('LocalPort')}\",\n                    \"remote\": f\"{entry.get('ForeignAddr')}:{entry.get('ForeignPort')}\",\n                    \"state\": entry.get(\"State\"),\n                    \"protocol\": entry.get(\"Proto\"),\n                }\n                connections.append(conn)\n\n        self.results[\"network_connections\"] = connections\n        return connections\n\n    def extract_dlls(self, pid=None):\n        \"\"\"List loaded DLLs per process.\"\"\"\n        print(f\"[+] Running windows.dlllist{f' (PID {pid})' if pid else ''}\")\n        args = [\"--pid\", str(pid)] if pid else None\n        results = self.run_plugin(\"windows.dlllist\", args)\n\n        dlls = []\n        if results:\n            for entry in results:\n                dlls.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"base\": entry.get(\"Base\"),\n                    \"name\": entry.get(\"Name\"),\n                    \"path\": entry.get(\"Path\"),\n                    \"size\": entry.get(\"Size\"),\n                })\n\n        self.results[\"loaded_dlls\"] = dlls\n        return dlls\n\n    def scan_with_yara(self, rules_path):\n        \"\"\"Scan memory with YARA rules.\"\"\"\n        print(f\"[+] Running windows.yarascan with {rules_path}\")\n        results = self.run_plugin(\n            \"windows.yarascan\",\n            [\"--yara-file\", rules_path]\n        )\n\n        matches = []\n        if results:\n            for entry in results:\n                matches.append({\n                    \"rule\": entry.get(\"Rule\"),\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"offset\": entry.get(\"Offset\"),\n                })\n\n        self.results[\"yara_matches\"] = matches\n        return matches\n\n    def full_triage(self):\n        \"\"\"Run full malware-focused memory triage.\"\"\"\n        print(f\"[*] Full memory triage: {self.dump_path}\")\n        print(\"=\" * 60)\n\n        self.detect_process_injection()\n        self.find_hidden_processes()\n        self.analyze_network()\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmemory_dump>\")\n        sys.exit(1)\n\n    analyzer = Vol3Analyzer(sys.argv[1])\n    results = analyzer.full_triage()\n    print(json.dumps(results, indent=2, default=str))\n```\n\n## Validation Criteria\n\n- Memory dump successfully parsed with correct OS profile\n- Injected processes detected via malfind with RWX regions\n- Hidden processes identified through pslist\u002Fpsscan comparison\n- Network connections reveal C2 communication endpoints\n- YARA rules match known malware signatures in memory\n- Credential artifacts extracted from lsass process memory\n\n## References\n\n- [Volatility Foundation](https:\u002F\u002Fvolatilityfoundation.org\u002F)\n- [Volatility3 GitHub](https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3)\n- [2024 Volatility Plugin Contest](https:\u002F\u002Fvolatilityfoundation.org\u002Fthe-2024-volatility-plugin-contest-results-are-in\u002F)\n- [Memory Forensics with Volatility 3](https:\u002F\u002Fnewtonpaul.com\u002Fmalware-analysis-memory-forensics-with-volatility-3\u002F)\n- [MITRE ATT&CK T1055 - Process Injection](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F)\n","# Performing Memory Forensics with Volatility3 Plugins\n\n## Overview\n\nVolatility3 (v2.26.0+, feature parity release May 2025) is the standard framework for memory forensics, replacing the deprecated Volatility2. It analyzes RAM dumps from Windows, Linux, and macOS to detect malicious processes, code injection, rootkits, credential harvesting, and network connections that disk-based forensics cannot reveal. Key plugins include `windows.malfind` (detecting RWX memory regions indicating injection), `windows.psscan` (finding hidden processes), `windows.dlllist` (enumerating loaded modules), `windows.netscan` (active network connections), and `windows.handles` (open file\u002Fregistry handles). The 2024 Plugin Contest introduced ETW Scan for extracting Event Tracing for Windows data from memory.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing memory forensics with volatility3 plugins\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `volatility3` framework installed\n- Memory dump files (`.raw`, `.dmp`, `.vmem`, `.lime`)\n- Windows symbol tables (ISF files, auto-downloaded)\n- Understanding of Windows process memory architecture\n- YARA integration for in-memory pattern scanning\n\n## Workflow\n\n### Step 1: Process Analysis for Malware Detection\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Volatility3-based memory forensics automation for malware analysis.\"\"\"\nimport subprocess\nimport json\nimport sys\nimport os\n\n\nclass Vol3Analyzer:\n    \"\"\"Automate Volatility3 plugin execution for malware analysis.\"\"\"\n\n    def __init__(self, dump_path, vol3_path=\"vol\"):\n        self.dump_path = dump_path\n        self.vol3 = vol3_path\n        self.results = {}\n\n    def run_plugin(self, plugin, extra_args=None):\n        \"\"\"Execute a Volatility3 plugin and capture output.\"\"\"\n        cmd = [\n            self.vol3, \"-f\", self.dump_path,\n            \"-r\", \"json\", plugin,\n        ]\n        if extra_args:\n            cmd.extend(extra_args)\n\n        try:\n            result = subprocess.run(\n                cmd, capture_output=True, text=True, timeout=300\n            )\n            if result.returncode == 0:\n                return json.loads(result.stdout)\n        except (subprocess.TimeoutExpired, json.JSONDecodeError) as e:\n            print(f\"  [!] {plugin} failed: {e}\")\n        return None\n\n    def detect_process_injection(self):\n        \"\"\"Use malfind to detect injected code regions.\"\"\"\n        print(\"[+] Running windows.malfind (code injection detection)\")\n        results = self.run_plugin(\"windows.malfind\")\n\n        injected = []\n        if results:\n            for entry in results:\n                injected.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"address\": entry.get(\"Start VPN\"),\n                    \"protection\": entry.get(\"Protection\"),\n                    \"hexdump\": entry.get(\"Hexdump\", \"\")[:200],\n                })\n                print(f\"  [!] Injection in PID {entry.get('PID')} \"\n                      f\"({entry.get('Process')}) at {entry.get('Start VPN')}\")\n\n        self.results[\"injected_processes\"] = injected\n        return injected\n\n    def find_hidden_processes(self):\n        \"\"\"Compare pslist vs psscan to find hidden processes.\"\"\"\n        print(\"[+] Running process comparison (pslist vs psscan)\")\n\n        pslist = self.run_plugin(\"windows.pslist\")\n        psscan = self.run_plugin(\"windows.psscan\")\n\n        if not pslist or not psscan:\n            return []\n\n        list_pids = {e.get(\"PID\") for e in pslist}\n        scan_pids = {e.get(\"PID\") for e in psscan}\n\n        hidden = scan_pids - list_pids\n        if hidden:\n            print(f\"  [!] {len(hidden)} hidden processes found!\")\n            for entry in psscan:\n                if entry.get(\"PID\") in hidden:\n                    print(f\"    PID {entry['PID']}: {entry.get('ImageFileName')}\")\n\n        self.results[\"hidden_processes\"] = list(hidden)\n        return list(hidden)\n\n    def analyze_network(self):\n        \"\"\"Extract active network connections.\"\"\"\n        print(\"[+] Running windows.netscan\")\n        results = self.run_plugin(\"windows.netscan\")\n\n        connections = []\n        if results:\n            for entry in results:\n                conn = {\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Owner\"),\n                    \"local\": f\"{entry.get('LocalAddr')}:{entry.get('LocalPort')}\",\n                    \"remote\": f\"{entry.get('ForeignAddr')}:{entry.get('ForeignPort')}\",\n                    \"state\": entry.get(\"State\"),\n                    \"protocol\": entry.get(\"Proto\"),\n                }\n                connections.append(conn)\n\n        self.results[\"network_connections\"] = connections\n        return connections\n\n    def extract_dlls(self, pid=None):\n        \"\"\"List loaded DLLs per process.\"\"\"\n        print(f\"[+] Running windows.dlllist{f' (PID {pid})' if pid else ''}\")\n        args = [\"--pid\", str(pid)] if pid else None\n        results = self.run_plugin(\"windows.dlllist\", args)\n\n        dlls = []\n        if results:\n            for entry in results:\n                dlls.append({\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"base\": entry.get(\"Base\"),\n                    \"name\": entry.get(\"Name\"),\n                    \"path\": entry.get(\"Path\"),\n                    \"size\": entry.get(\"Size\"),\n                })\n\n        self.results[\"loaded_dlls\"] = dlls\n        return dlls\n\n    def scan_with_yara(self, rules_path):\n        \"\"\"Scan memory with YARA rules.\"\"\"\n        print(f\"[+] Running windows.yarascan with {rules_path}\")\n        results = self.run_plugin(\n            \"windows.yarascan\",\n            [\"--yara-file\", rules_path]\n        )\n\n        matches = []\n        if results:\n            for entry in results:\n                matches.append({\n                    \"rule\": entry.get(\"Rule\"),\n                    \"pid\": entry.get(\"PID\"),\n                    \"process\": entry.get(\"Process\"),\n                    \"offset\": entry.get(\"Offset\"),\n                })\n\n        self.results[\"yara_matches\"] = matches\n        return matches\n\n    def full_triage(self):\n        \"\"\"Run full malware-focused memory triage.\"\"\"\n        print(f\"[*] Full memory triage: {self.dump_path}\")\n        print(\"=\" * 60)\n\n        self.detect_process_injection()\n        self.find_hidden_processes()\n        self.analyze_network()\n\n        return self.results\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cmemory_dump>\")\n        sys.exit(1)\n\n    analyzer = Vol3Analyzer(sys.argv[1])\n    results = analyzer.full_triage()\n    print(json.dumps(results, indent=2, default=str))\n```\n\n## Validation Criteria\n\n- Memory dump successfully parsed with correct OS profile\n- Injected processes detected via malfind with RWX regions\n- Hidden processes identified through pslist\u002Fpsscan comparison\n- Network connections reveal C2 communication endpoints\n- YARA rules match known malware signatures in memory\n- Credential artifacts extracted from lsass process memory\n\n## References\n\n- [Volatility Foundation](https:\u002F\u002Fvolatilityfoundation.org\u002F)\n- [Volatility3 GitHub](https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3)\n- [2024 Volatility Plugin Contest](https:\u002F\u002Fvolatilityfoundation.org\u002Fthe-2024-volatility-plugin-contest-results-are-in\u002F)\n- [Memory Forensics with Volatility 3](https:\u002F\u002Fnewtonpaul.com\u002Fmalware-analysis-memory-forensics-with-volatility-3\u002F)\n- [MITRE ATT&CK T1055 - Process Injection](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1055\u002F)\n",{"name":5,"tags":49,"author":52,"domain":42,"license":15,"version":53,"nist_csf":54,"subdomain":50,"description":7,"mitre_attack":59,"d3fend_techniques":65},[29,28,50,51,35,30,36],"malware-analysis","incident-response","mahipal","1.0",[55,56,57,58],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[60,61,62,63,64],"T1027","T1055","T1140","T1497","T1003",[66,67,68,69,70],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-memory-forensics-with-volatility3-plugins",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3-plugins",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3-plugins",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3-plugins","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FSKILL.md",true,[95,101,106,112,116,120,126],{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"assets\u002Ftemplate.md","ASSET","资产文件",651,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fassets\u002Ftemplate.md",{"path":102,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002FLICENSE",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fapi-reference.md","REFERENCE","参考文档",1852,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fapi-reference.md",{"path":113,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fstandards.md",1128,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fstandards.md",{"path":117,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":118,"sourceHtmlUrl":119},"references\u002Fworkflows.md",722,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Freferences\u002Fworkflows.md",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fagent.py","SCRIPT","脚本",7377,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fscripts\u002Fagent.py",{"path":127,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fprocess.py",1877,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3-plugins\u002Fscripts\u002Fprocess.py",[131,157,181,208,232,259],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,143,42,144,145,146,40,147,148,149,150,151,152,153,154,155,156],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,153,166,167,143,168,42,146,169,170,171,172,173,174,175,176,177,178,179,180],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":191,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[187,190],{"categoryNo":188,"categoryName":189,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[175,192,193,194,195,42,196,197,169,198,199,51,200,201,202,203,204,205,206,207],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[214],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[41,216,217,42,218,219,220,221,36,222,223,224,225,226,227,228,172,229,230,231],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,42,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,267,42,268,269,270,271,272,273,274,275,203,33,204,31,276,277,278,279,280],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]