Does this skill support Windows memory analysis?

No, this specific skill is tailored for Linux environments, utilizing Linux-specific kernel modules and Volatility 3 plugins like linux.pslist and linux.bash.

Why is Volatility 3 used instead of Volatility 2?

Volatility 3 is the modern rewritten framework that offers better performance, improved Linux support, and does not require pre-generated profiles, making it more efficient for automated analysis.

What is the purpose of using LiME in this skill?

LiME (Linux Memory Extractor) is used to capture a full memory image from a live Linux system, ensuring volatile evidence is preserved for forensic analysis before it is lost.

Can this skill detect rootkits?

Yes, by comparing results from different plugins (like pslist vs psscan) and auditing loaded kernel modules with linux.lsmod, it can help identify hidden or malicious kernel-level modifications.

Is Python required to run these forensic tools?

Yes, Volatility 3 is a Python-based framework, and this skill expects a Python 3.8+ environment with the necessary dependencies installed for execution.

Linux Memory Forensics (LiME & Volatility)

Name: Linux Memory Forensics (LiME & Volatility)
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Performs Linux memory acquisition and advanced forensic analysis using LiME and Volatility 3 to detect malicious activity and compromises.

This skill provides specialized capabilities for performing deep memory forensics on Linux systems, enabling security professionals and AI agents to extract critical evidence following a security incident. It facilitates the acquisition of memory images using the LiME (Linux Memory Extractor) kernel module and subsequent analysis via the Volatility 3 framework. By extracting process lists, network connections, bash command history, and loaded kernel modules, this skill helps identify hidden malware, rootkits, and unauthorized user activity that might not be visible through standard system utilities.

主要功能

01Kernel module auditing to identify potential rootkits or malicious injections

024,121 GitHub stars

03Network socket and connection state investigation

04Comprehensive process analysis including hidden process detection

05Extraction of bash command history for user activity tracking

06Automated Linux memory acquisition via LiME kernel module

使用场景

01Threat hunting for memory-resident malware or fileless attack techniques

02Performing live incident response on a suspected compromised Linux server

03Forensic validation of security alerts by analyzing volatile system data

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-memory-forensics-with-lime-and-volatility

For use in Claude.ai and ChatGPT

主要功能

01Kernel module auditing to identify potential rootkits or malicious injections

024,121 GitHub stars

03Network socket and connection state investigation

04Comprehensive process analysis including hidden process detection

05Extraction of bash command history for user activity tracking

06Automated Linux memory acquisition via LiME kernel module

使用场景

01Threat hunting for memory-resident malware or fileless attack techniques

02Performing live incident response on a suspected compromised Linux server

03Forensic validation of security alerts by analyzing volatile system data

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-memory-forensics-with-lime-and-volatility

For use in Claude.ai and ChatGPT