How does this skill handle evidence integrity?

The workflow includes immediate SHA256 hashing of all collected dumps and logs, along with a structured template for documenting the chain of custody, ensuring the evidence remains admissible.

Is authorization required to use this skill?

Yes, forensic collection should always be performed with proper legal, HR, or organizational authorization to ensure the resulting evidence is ethically and legally sound.

Does this skill work on Windows and Linux?

Yes, it includes specific commands and workflows for Windows (WinPmem, Sysinternals), Linux (LiME, procfs), and macOS (osxpmem) to ensure comprehensive coverage across different operating systems.

Why is collecting volatile evidence first important?

Volatile data, like system memory and network connections, is lost when a system is shut down or rebooted. This skill follows the RFC 3227 order of volatility to ensure the most fragile data is captured first.

Can I use this for fileless malware detection?

Absolutely. It focuses on capturing memory dumps and process trees, which are often the only places fileless malware leaves traces that aren't visible on the physical disk.

Volatile Forensic Evidence Collection

Name: Volatile Forensic Evidence Collection
Author: mukul975

bymukul975

•

4,121

•

セキュリティとテスト

Collects time-sensitive forensic data from compromised hosts to preserve memory, network state, and running processes for incident response.

This skill provides a standardized workflow for Digital Forensics and Incident Response (DFIR) professionals to capture volatile evidence from compromised systems before it is lost. Following the RFC 3227 order of volatility, it guides the user through memory acquisition, network connection mapping, process tree extraction, and user session logging across Windows, Linux, and macOS. It ensures forensic integrity by incorporating immediate hashing and chain of custody documentation, making it essential for root cause analysis and legal preservation in the event of fileless malware or active cyberattacks.

主な機能

01Standardized RFC 3227 order of volatility collection

02Cross-platform support for Windows, Linux, and macOS environments

03Automated SHA256 hashing for evidence integrity verification

04Built-in chain of custody documentation templates

054,121 GitHub stars

06Comprehensive capture of memory, network connections, and hidden process states

ユースケース

01Identifying active C2 (Command & Control) connections during a live breach

02Documenting system state for legal proceedings or compliance audits

03Preserving evidence from memory-resident (fileless) malware attacks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-volatile-evidence-from-compromised-host

For use in Claude.ai and ChatGPT

主な機能

01Standardized RFC 3227 order of volatility collection

02Cross-platform support for Windows, Linux, and macOS environments

03Automated SHA256 hashing for evidence integrity verification

04Built-in chain of custody documentation templates

054,121 GitHub stars

06Comprehensive capture of memory, network connections, and hidden process states

ユースケース

01Identifying active C2 (Command & Control) connections during a live breach

02Documenting system state for legal proceedings or compliance audits

03Preserving evidence from memory-resident (fileless) malware attacks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills collecting-volatile-evidence-from-compromised-host

For use in Claude.ai and ChatGPT