[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFXEEP0MZ9B2ZQSEATSCJM":3,"skill-same:01M6AFXEEP0MZ9B2ZQSEATSCJM":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":72,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6AFXEEP0MZ9B2ZQSEATSCJM","performing-memory-forensics-with-volatility3",null,"Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes\u002Frootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing memory forensics with volatility3","forensics","volatility3","memory","network","malware-detection","credentials","analysis","t1074","injection","t1059","digital-forensics","encryption","RAM-analysis","Volatility","memory-forensics","malware","framework","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-memory-forensics-with-volatility3\ndescription: Analyze volatile memory (RAM) dumps using the Volatility 3 framework\n  to extract running processes, network connections, loaded modules, credentials,\n  and encryption keys, and to detect process hollowing, DLL injection, or hidden\n  processes\u002Frootkits. Use during incident response on a compromised or suspect system\n  when disk-based forensics alone is insufficient and volatile evidence of malware\n  or intrusion must be recovered from memory.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- memory-forensics\n- volatility\n- ram-analysis\n- malware-detection\n- incident-response\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing Memory Forensics with Volatility 3\n\n## When to Use\n- When analyzing a RAM dump from a compromised or suspect system\n- During incident response to identify running malware, injected code, or rootkits\n- When you need to extract credentials, encryption keys, or network connections from memory\n- For detecting process hollowing, DLL injection, or hidden processes\n- When disk-based forensics alone is insufficient and volatile data is critical\n\n## Prerequisites\n- Python 3.7+ installed\n- Volatility 3 framework installed (`pip install volatility3`)\n- Memory dump in raw, ELF, or crash dump format\n- Appropriate symbol tables (ISF files) for the target OS version\n- Sufficient disk space for analysis output (2-3x memory dump size)\n- Optional: YARA rules for malware scanning in memory\n\n## Workflow\n\n### Step 1: Acquire Memory Dump and Install Volatility 3\n\n```bash\n# Install Volatility 3\npip install volatility3\n\n# Or install from source for latest features\ngit clone https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3.git\ncd volatility3\npip install -e .\n\n# Download Windows symbol tables (ISF packs)\n# Place in volatility3\u002Fsymbols\u002F directory\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Fwindows.zip\nunzip windows.zip -d \u002Fopt\u002Fvolatility3\u002Fvolatility3\u002Fsymbols\u002F\n\n# Download Linux and Mac symbol packs\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Flinux.zip\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Fmac.zip\n\n# Memory acquisition tools (for live systems):\n# Windows: winpmem, DumpIt, FTK Imager\n# Linux: LiME (Linux Memory Extractor)\nsudo insmod lime-$(uname -r).ko \"path=\u002Fcases\u002Fmemory\u002Flinux_mem.lime format=lime\"\n\n# Verify the memory dump\nfile \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\nls -lh \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\n```\n\n### Step 2: Identify the Operating System Profile\n\n```bash\n# Run banners plugin to identify the OS\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw banners\n\n# For Windows, identify the OS version\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.info\n\n# Output example:\n# Variable        Value\n# Kernel Base     0xf8047e200000\n# DTB             0x1ad000\n# Symbols         ntkrnlmp.pdb\u002FGUID\n# Is64Bit         True\n# IsPAE           False\n# primary layer   Intel32e\n# KdVersionBlock  0xf8047ee232c0\n# Major\u002FMinor     15.19041\n# Machine Type    34404\n# KeNumberProcessors 4\n# SystemTime      2024-01-18 14:32:15 UTC\n# NtBuildLab      19041.1.amd64fre.vb_release.191206-1406\n# NtProductType   NtProductWinNt\n# NtSystemRoot    C:\\WINDOWS\n# PE MajorOperatingSystemVersion 10\n# PE MinorOperatingSystemVersion 0\n\n# For Linux memory dumps\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Flinux_mem.lime linux.info\n```\n\n### Step 3: Enumerate Processes and Detect Anomalies\n\n```bash\n# List all running processes\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pslist | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpslist.txt\n\n# Show process tree (parent-child relationships)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pstree | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpstree.txt\n\n# Detect hidden processes using cross-view analysis\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.psscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpsscan.txt\n\n# Compare pslist vs psscan to find hidden processes\ndiff \u003C(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \\\n     \u003C(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)\n\n# List DLLs loaded by a suspicious process (PID 4532)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dlllist --pid 4532\n\n# Check for process hollowing and injection\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.malfind | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmalfind.txt\n\n# Dump suspicious process memory for further analysis\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.memmap --pid 4532 --dump \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdumps\u002F\n```\n\n### Step 4: Analyze Network Connections and Registry\n\n```bash\n# List active network connections\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetscan.txt\n\n# Filter for established connections\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | grep ESTABLISHED\n\n# Filter for listening ports\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | grep LISTENING\n\n# Extract network connections with process mapping\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netstat | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetstat.txt\n\n# Dump registry hives from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.registry.hivelist\n\n# Extract specific registry keys\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.registry.printkey \\\n   --key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Check services\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.svcscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fservices.txt\n```\n\n### Step 5: Extract Credentials and Sensitive Data\n\n```bash\n# Dump cached credentials (hashdump)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.hashdump | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhashes.txt\n\n# Extract LSA secrets\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.lsadump\n\n# Dump cached domain credentials\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cachedump\n\n# Search for plaintext strings in process memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings --pid 4532 \\\n   | grep -iE '(password|credential|token|api.key)'\n\n# Extract command history from cmd.exe\u002Fpowershell\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cmdline | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcmdline.txt\n\n# Extract environment variables\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.envars --pid 4532\n```\n\n### Step 6: Scan for Malware with YARA Rules\n\n```bash\n# Scan memory with YARA rules\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n   --yara-file \u002Fopt\u002Fyara-rules\u002Fmalware_index.yar | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fyara_hits.txt\n\n# Scan specific process memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n   --yara-file \u002Fopt\u002Fyara-rules\u002Fapt_rules.yar --pid 4532\n\n# Check loaded kernel modules for rootkits\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.modules | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmodules.txt\n\n# Detect unlinked\u002Fhidden modules\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.modscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmodscan.txt\n\n# Check for SSDT hooks (System Service Descriptor Table)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Dump a suspicious executable from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles --pid 4532 \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fextracted\u002F\n```\n\n### Step 7: Compile Findings into a Report\n\n```bash\n# Generate comprehensive analysis summary\necho \"=== MEMORY FORENSICS REPORT ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"Image: memory.raw\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"OS: Windows 10 Build 19041\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- Suspicious Processes ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmalfind.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- Network Connections ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetscan.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- YARA Matches ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fyara_hits.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\n# Calculate hash of the memory dump for integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Volatile data | Information that exists only in RAM and is lost when power is removed |\n| Process hollowing | Technique where malware replaces legitimate process memory with malicious code |\n| DLL injection | Loading unauthorized DLLs into a running process address space |\n| EPROCESS | Windows kernel structure representing a process; basis for process listing |\n| Pool scanning | Searching memory for kernel object signatures to find hidden artifacts |\n| VAD (Virtual Address Descriptor) | Memory management structure tracking process virtual memory regions |\n| ISF (Intermediate Symbol Format) | Volatility 3 symbol table format for OS-specific structure definitions |\n| Malfind | Plugin detecting injected code by examining VAD permissions and content |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Volatility 3 | Primary open-source memory forensics framework |\n| LiME | Linux Memory Extractor for acquiring Linux RAM dumps |\n| WinPmem | Windows physical memory acquisition driver |\n| DumpIt | Comae one-click Windows memory dump utility |\n| YARA | Pattern matching engine for malware signature scanning |\n| Rekall | Alternative memory forensics framework (Google) |\n| MemProcFS | Memory process file system for memory analysis |\n| strings | Extract printable strings from binary memory dumps |\n\n## Common Scenarios\n\n**Scenario 1: Active Malware Investigation**\nAcquire memory with DumpIt, run pslist\u002Fpstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.\n\n**Scenario 2: Credential Theft After Breach**\nRun hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.\n\n**Scenario 3: Rootkit Detection**\nCompare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.\n\n**Scenario 4: Ransomware Incident Recovery**\nExtract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.\n\n## Output Format\n\n```\nMemory Forensics Analysis:\n  Image:            memory.raw (16 GB)\n  OS Identified:    Windows 10 x64 Build 19041\n  Capture Time:     2024-01-18 14:32:15 UTC\n\n  Process Analysis:\n    Total Processes:    87\n    Hidden Processes:   2 (PIDs: 4532, 6128)\n    Injected Processes: 3 (malfind detections)\n    Suspicious:         svchost.exe (PID 4532) - injected code at 0x7FFE0000\n\n  Network Connections:\n    Total:        45\n    Established:  12\n    Suspicious:   3 (C2 connections to 185.xx.xx.xx:443)\n\n  Credentials Found:\n    NTLM Hashes:      4 accounts\n    Cached Creds:      2 domain accounts\n\n  YARA Matches:\n    CobaltStrike_Beacon:  PID 4532 (3 hits)\n    Mimikatz_Memory:      PID 6128 (1 hit)\n\n  Extracted Artifacts:   15 files dumped to \u002Fanalysis\u002Fextracted\u002F\n```\n","# Performing Memory Forensics with Volatility 3\n\n## When to Use\n- When analyzing a RAM dump from a compromised or suspect system\n- During incident response to identify running malware, injected code, or rootkits\n- When you need to extract credentials, encryption keys, or network connections from memory\n- For detecting process hollowing, DLL injection, or hidden processes\n- When disk-based forensics alone is insufficient and volatile data is critical\n\n## Prerequisites\n- Python 3.7+ installed\n- Volatility 3 framework installed (`pip install volatility3`)\n- Memory dump in raw, ELF, or crash dump format\n- Appropriate symbol tables (ISF files) for the target OS version\n- Sufficient disk space for analysis output (2-3x memory dump size)\n- Optional: YARA rules for malware scanning in memory\n\n## Workflow\n\n### Step 1: Acquire Memory Dump and Install Volatility 3\n\n```bash\n# Install Volatility 3\npip install volatility3\n\n# Or install from source for latest features\ngit clone https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility3.git\ncd volatility3\npip install -e .\n\n# Download Windows symbol tables (ISF packs)\n# Place in volatility3\u002Fsymbols\u002F directory\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Fwindows.zip\nunzip windows.zip -d \u002Fopt\u002Fvolatility3\u002Fvolatility3\u002Fsymbols\u002F\n\n# Download Linux and Mac symbol packs\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Flinux.zip\nwget https:\u002F\u002Fdownloads.volatilityfoundation.org\u002Fvolatility3\u002Fsymbols\u002Fmac.zip\n\n# Memory acquisition tools (for live systems):\n# Windows: winpmem, DumpIt, FTK Imager\n# Linux: LiME (Linux Memory Extractor)\nsudo insmod lime-$(uname -r).ko \"path=\u002Fcases\u002Fmemory\u002Flinux_mem.lime format=lime\"\n\n# Verify the memory dump\nfile \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\nls -lh \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw\n```\n\n### Step 2: Identify the Operating System Profile\n\n```bash\n# Run banners plugin to identify the OS\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw banners\n\n# For Windows, identify the OS version\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.info\n\n# Output example:\n# Variable        Value\n# Kernel Base     0xf8047e200000\n# DTB             0x1ad000\n# Symbols         ntkrnlmp.pdb\u002FGUID\n# Is64Bit         True\n# IsPAE           False\n# primary layer   Intel32e\n# KdVersionBlock  0xf8047ee232c0\n# Major\u002FMinor     15.19041\n# Machine Type    34404\n# KeNumberProcessors 4\n# SystemTime      2024-01-18 14:32:15 UTC\n# NtBuildLab      19041.1.amd64fre.vb_release.191206-1406\n# NtProductType   NtProductWinNt\n# NtSystemRoot    C:\\WINDOWS\n# PE MajorOperatingSystemVersion 10\n# PE MinorOperatingSystemVersion 0\n\n# For Linux memory dumps\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Flinux_mem.lime linux.info\n```\n\n### Step 3: Enumerate Processes and Detect Anomalies\n\n```bash\n# List all running processes\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pslist | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpslist.txt\n\n# Show process tree (parent-child relationships)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.pstree | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpstree.txt\n\n# Detect hidden processes using cross-view analysis\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.psscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fpsscan.txt\n\n# Compare pslist vs psscan to find hidden processes\ndiff \u003C(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \\\n     \u003C(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)\n\n# List DLLs loaded by a suspicious process (PID 4532)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dlllist --pid 4532\n\n# Check for process hollowing and injection\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.malfind | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmalfind.txt\n\n# Dump suspicious process memory for further analysis\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.memmap --pid 4532 --dump \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fdumps\u002F\n```\n\n### Step 4: Analyze Network Connections and Registry\n\n```bash\n# List active network connections\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetscan.txt\n\n# Filter for established connections\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | grep ESTABLISHED\n\n# Filter for listening ports\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netscan | grep LISTENING\n\n# Extract network connections with process mapping\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.netstat | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetstat.txt\n\n# Dump registry hives from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.registry.hivelist\n\n# Extract specific registry keys\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.registry.printkey \\\n   --key \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n\n# Check services\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.svcscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fservices.txt\n```\n\n### Step 5: Extract Credentials and Sensitive Data\n\n```bash\n# Dump cached credentials (hashdump)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.hashdump | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fhashes.txt\n\n# Extract LSA secrets\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.lsadump\n\n# Dump cached domain credentials\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cachedump\n\n# Search for plaintext strings in process memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.strings --pid 4532 \\\n   | grep -iE '(password|credential|token|api.key)'\n\n# Extract command history from cmd.exe\u002Fpowershell\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.cmdline | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fcmdline.txt\n\n# Extract environment variables\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.envars --pid 4532\n```\n\n### Step 6: Scan for Malware with YARA Rules\n\n```bash\n# Scan memory with YARA rules\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n   --yara-file \u002Fopt\u002Fyara-rules\u002Fmalware_index.yar | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fyara_hits.txt\n\n# Scan specific process memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw yarascan \\\n   --yara-file \u002Fopt\u002Fyara-rules\u002Fapt_rules.yar --pid 4532\n\n# Check loaded kernel modules for rootkits\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.modules | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmodules.txt\n\n# Detect unlinked\u002Fhidden modules\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.modscan | tee \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmodscan.txt\n\n# Check for SSDT hooks (System Service Descriptor Table)\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Dump a suspicious executable from memory\nvol -f \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw windows.dumpfiles --pid 4532 \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fextracted\u002F\n```\n\n### Step 7: Compile Findings into a Report\n\n```bash\n# Generate comprehensive analysis summary\necho \"=== MEMORY FORENSICS REPORT ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"Image: memory.raw\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"OS: Windows 10 Build 19041\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\necho \"\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- Suspicious Processes ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmalfind.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- Network Connections ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fnetscan.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\necho \"--- YARA Matches ---\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\ncat \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fyara_hits.txt >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n\n# Calculate hash of the memory dump for integrity\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmemory\u002Fmemory.raw >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fmemory_report.txt\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Volatile data | Information that exists only in RAM and is lost when power is removed |\n| Process hollowing | Technique where malware replaces legitimate process memory with malicious code |\n| DLL injection | Loading unauthorized DLLs into a running process address space |\n| EPROCESS | Windows kernel structure representing a process; basis for process listing |\n| Pool scanning | Searching memory for kernel object signatures to find hidden artifacts |\n| VAD (Virtual Address Descriptor) | Memory management structure tracking process virtual memory regions |\n| ISF (Intermediate Symbol Format) | Volatility 3 symbol table format for OS-specific structure definitions |\n| Malfind | Plugin detecting injected code by examining VAD permissions and content |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Volatility 3 | Primary open-source memory forensics framework |\n| LiME | Linux Memory Extractor for acquiring Linux RAM dumps |\n| WinPmem | Windows physical memory acquisition driver |\n| DumpIt | Comae one-click Windows memory dump utility |\n| YARA | Pattern matching engine for malware signature scanning |\n| Rekall | Alternative memory forensics framework (Google) |\n| MemProcFS | Memory process file system for memory analysis |\n| strings | Extract printable strings from binary memory dumps |\n\n## Common Scenarios\n\n**Scenario 1: Active Malware Investigation**\nAcquire memory with DumpIt, run pslist\u002Fpstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.\n\n**Scenario 2: Credential Theft After Breach**\nRun hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.\n\n**Scenario 3: Rootkit Detection**\nCompare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.\n\n**Scenario 4: Ransomware Incident Recovery**\nExtract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.\n\n## Output Format\n\n```\nMemory Forensics Analysis:\n  Image:            memory.raw (16 GB)\n  OS Identified:    Windows 10 x64 Build 19041\n  Capture Time:     2024-01-18 14:32:15 UTC\n\n  Process Analysis:\n    Total Processes:    87\n    Hidden Processes:   2 (PIDs: 4532, 6128)\n    Injected Processes: 3 (malfind detections)\n    Suspicious:         svchost.exe (PID 4532) - injected code at 0x7FFE0000\n\n  Network Connections:\n    Total:        45\n    Established:  12\n    Suspicious:   3 (C2 connections to 185.xx.xx.xx:443)\n\n  Credentials Found:\n    NTLM Hashes:      4 accounts\n    Cached Creds:      2 domain accounts\n\n  YARA Matches:\n    CobaltStrike_Beacon:  PID 4532 (3 hits)\n    Mimikatz_Memory:      PID 6128 (1 hit)\n\n  Extracted Artifacts:   15 files dumped to \u002Fanalysis\u002Fextracted\u002F\n```\n",{"name":5,"tags":49,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":35,"description":7,"mitre_attack":59},[25,39,50,51,29,52],"volatility","ram-analysis","incident-response","mahipal","1.0",[56,57,58],"RS.AN-03","DE.AE-02","RS.MA-01",[60,61,62,63,64],"T1005","T1074","T1119","T1070","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-memory-forensics-with-volatility3",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3",{"tool":81,"command":82},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3",{"tool":84,"command":85},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-memory-forensics-with-volatility3","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002FSKILL.md",true,[89,94,100,106],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",1865,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",5767,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":108,"sourceHtmlUrl":109},"SKILL.es.md",2240,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-memory-forensics-with-volatility3\u002FSKILL.es.md",[111,137,161,188,213,239],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,123,43,42,124,125,126,127,128,129,130,131,132,133,134,135,136],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,133,146,147,123,148,43,125,149,150,151,152,153,154,155,156,157,158,159,160],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[167,170],{"categoryNo":168,"categoryName":169,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,172,173,174,175,43,176,177,149,178,179,52,180,181,182,183,184,185,186,187],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[194],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,198,43,199,200,201,202,203,204,205,206,207,208,35,209,152,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,41,222,43,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,247,43,248,249,250,251,252,253,254,255,183,256,184,31,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]