Analysis & spreadsheets35k · #6102

performing-memory-forensics-with-volatility3

Lets your agent examine system RAM to find processes, connections, and secrets. It's important for investigating cybercrimes when the disk isn't enough.

What it does

This tool analyzes a computer's RAM to find information about running programs, network connections, saved passwords, and potential malware. It's useful when you suspect a computer has been compromised and disk analysis alone isn't enough.

When to use it

✓When you suspect a computer has been compromised.
✓To investigate suspicious activity on a system.
✓To recover important information that might be lost or hidden.

Example of what to ask your AI

“Analyze the RAM of this computer to find suspicious processes and network connections.”

Want more? Open the sections below.

How to use

The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.

Skill link

https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/main/skills/performing-memory-forensics-with-volatility3/SKILL.md

Ready-to-paste message

Use this skill to help me: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/main/skills/performing-memory-forensics-with-volatility3/SKILL.md Read the SKILL.md file at that link and follow its instructions for my task.

View on GitHub ↗Raw file

How it works

The tool uses a program called Volatility 3 to examine a file containing an exact copy of the computer's RAM. It looks for known patterns of malicious activity or important information.

Installation

Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.

In the terminal (Claude Code, Codex, Cursor), in your project folder:

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3

Or download just the file:

curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/performing-memory-forensics-with-volatility3/SKILL.md -o SKILL.md

Technical content (original SKILL.md)

Original text by the author, straight from GitHub.

Performing Memory Forensics with Volatility 3

When to Use

When analyzing a RAM dump from a compromised or suspect system
During incident response to identify running malware, injected code, or rootkits
When you need to extract credentials, encryption keys, or network connections from memory
For detecting process hollowing, DLL injection, or hidden processes
When disk-based forensics alone is insufficient and volatile data is critical

Prerequisites

Python 3.7+ installed
Volatility 3 framework installed (pip install volatility3)
Memory dump in raw, ELF, or crash dump format
Appropriate symbol tables (ISF files) for the target OS version
Sufficient disk space for analysis output (2-3x memory dump size)
Optional: YARA rules for malware scanning in memory

Workflow

Step 1: Acquire Memory Dump and Install Volatility 3

# Install Volatility 3
pip install volatility3

# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .

# Download Windows symbol tables (ISF packs)
# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/

# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip

# Memory acquisition tools (for live systems):
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (Linux Memory Extractor)
sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"

# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw

Step 2: Identify the Operating System Profile

# Run banners plugin to identify the OS
vol -f /cases/case-2024-001/memory/memory.raw banners

# For Windows, identify the OS version
vol -f /cases/case-2024-001/memory/memory.raw windows.info

# Output example:
# Variable        Value
# Kernel Base     0xf8047e200000
# DTB             0x1ad000
# Symbols         ntkrnlmp.pdb/GUID
# Is64Bit         True
# IsPAE           False
# primary layer   Intel32e
# KdVersionBlock  0xf8047ee232c0
# Major/Minor     15.19041
# Machine Type    34404
# KeNumberProcessors 4
# SystemTime      2024-01-18 14:32:15 UTC
# NtBuildLab      19041.1.amd64fre.vb_release.191206-1406
# NtProductType   NtProductWinNt
# NtSystemRoot    C:\WINDOWS
# PE MajorOperatingSystemVersion 10
# PE MinorOperatingSystemVersion 0

# For Linux memory dumps
vol -f /cases/case-2024-001/memory/linux_mem.lime linux.info

Step 3: Enumerate Processes and Detect Anomalies

# List all running processes
vol -f /cases/case-2024-001/memory/memory.raw windows.pslist | tee /cases/case-2024-001/analysis/pslist.txt

# Show process tree (parent-child relationships)
vol -f /cases/case-2024-001/memory/memory.raw windows.pstree | tee /cases/case-2024-001/analysis/pstree.txt

# Detect hidden processes using cross-view analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.psscan | tee /cases/case-2024-001/analysis/psscan.txt

# Compare pslist vs psscan to find hidden processes
diff <(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \
     <(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)

# List DLLs loaded by a suspicious process (PID 4532)
vol -f /cases/case-2024-001/memory/memory.raw windows.dlllist --pid 4532

# Check for process hollowing and injection
vol -f /cases/case-2024-001/memory/memory.raw windows.malfind | tee /cases/case-2024-001/analysis/malfind.txt

# Dump suspicious process memory for further analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.memmap --pid 4532 --dump \
   -o /cases/case-2024-001/analysis/dumps/

Step 4: Analyze Network Connections and Registry

# List active network connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | tee /cases/case-2024-001/analysis/netscan.txt

# Filter for established connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep ESTABLISHED

# Filter for listening ports
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep LISTENING

# Extract network connections with process mapping
vol -f /cases/case-2024-001/memory/memory.raw windows.netstat | tee /cases/case-2024-001/analysis/netstat.txt


…

FAQ

What is 'volatile memory'?

Volatile memory is information a computer stores temporarily while it's turned on, like the programs that are currently running. This information is lost when the computer is turned off.

What is a 'memory dump'?

A 'memory dump' is an exact copy of everything that was in the computer's RAM at a specific moment. It's like taking a 'snapshot' of the memory.

Do I need to be an expert to use this?

The tool itself requires technical knowledge to install and configure, but the goal is for an expert to use this tool to answer simple questions about the memory.

Details

Original description by the author

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intr

repo: mukul975/Anthropic-Cybersecurity-Skills

Popularity

GitHub stars: 35k
Ranking position: #6102
License: Apache-2.0
Updated: 8/31/2026

Is this skill useful?

Comments

More skills from this repository

APIs & servers (backend)35k

abusing-dpapi-for-credential-access

Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.

mukul975/Anthropic-Cybersecurity-Skills

Writing35k

abusing-shadow-credentials-for-privesc

Teaches your AI agent to write clear, well-structured text.

mukul975/Anthropic-Cybersecurity-Skills

Misc35k

achieving-cmmc-level-2-compliance

Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.

mukul975/Anthropic-Cybersecurity-Skills

Misc35k

acquiring-disk-image-with-dd-and-dcfldd

Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.

mukul975/Anthropic-Cybersecurity-Skills

Similar skills

Analysis & spreadsheets280k

data-throughput-accelerator

Makes your agent speed up the movement of large data volumes. It finds bottlenecks and ensures data is transferred quickly and correctly.

affaan-m/ECC

Analysis & spreadsheets280k

inventory-demand-planning

Helps your agent predict product demand in stores. It optimizes stock and plans when to run promotions to sell more.

affaan-m/ECC

Analysis & spreadsheets280k

market-research

Helps your agent conduct market research and competitive analysis. Provides summaries with source attribution.

affaan-m/ECC