What is the primary tool used in this memory forensics skill?

The skill primarily focuses on the Volatility 3 Framework, which is the industry-standard tool for extracting digital artifacts from volatile memory (RAM) samples.

Does this skill cover memory acquisition?

Yes, it includes detailed instructions for using tools like WinPmem, LiME, and osxpmem to safely capture RAM from live systems without compromising forensic integrity.

Can I use this skill for Linux and macOS analysis?

Yes, the skill includes specialized commands, plugins, and acquisition techniques for analyzing memory dumps from Windows, Linux, and macOS systems.

Can I use YARA rules with this skill?

Absolutely. The skill includes guidance on writing memory-specific YARA rules and utilizing Volatility's yarascan plugin to find malware signatures across process and kernel memory.

How does this help with malware analysis?

It provides specific workflows to detect advanced techniques like process hollowing and injection, allowing you to dump suspicious code directly from memory for strings analysis or reverse engineering.

Memory Forensics Master

Name: Memory Forensics Master
Author: Microck

byMicrock

•

보안 및 테스팅

Master memory forensics techniques for incident response and malware analysis using Volatility and specialized acquisition tools.

This skill provides a comprehensive guide and toolkit for performing memory forensics across Windows, Linux, and macOS environments. It enables users to perform live memory acquisition, analyze process trees, detect code injection, and extract forensic artifacts using the Volatility 3 framework. Whether investigating a security breach or performing deep malware analysis, this skill offers structured workflows and commands for identifying hidden processes, registry keys, and network connections directly from RAM captures, providing critical visibility into volatile system states.

주요 기능

01Deep integration with Volatility 3 for process, network, and registry analysis

022 GitHub stars

03YARA rule integration for scanning memory dumps for specific threats

04Advanced detection patterns for process hollowing, DLL injection, and rootkits

05Cross-platform memory acquisition guides for Windows, Linux, and macOS

06Automated workflows for incident response and malware investigation

사용 사례

01Investigating active security incidents to identify malicious processes and network persistence

02Analyzing sophisticated malware that exists only in RAM to evade disk-based detection

03Recovering volatile evidence such as encryption keys, passwords, and command-line history

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add microck/opendots-microck memory-forensics

For use in Claude.ai and ChatGPT

Download Skill