Memory Forensics

When to use this skill

Use Memory Forensics when an AI agent needs a reusable SKILL.md workflow for this job: Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.

When not to use it

Skip Memory Forensics when the task is outside the coding category, or when a more specific skill in this directory already covers the same workflow with clearer triggers.

How to install

1. Personal install: create ~/.claude/skills/memory-forensics/SKILL.md (and any bundled scripts) so Claude Code, Claude Desktop, and compatible agents can load it in every project.
2. Project install: commit the same folder at .claude/skills/memory-forensics/ so teammates get the skill with the repo.
3. Restart the agent session after copying files so it re-scans the skills directory, then ask for the task in words that match the skill description.

Full install guide for Claude, Cursor, and Codex

What this skill does

# Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

## When to Use This Skill

- Performing memory analysis during incident response or breach investigation - Extracting malware artifacts (processes, injected code, network connections) from a RAM capture - Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown - Using Volatility 3 / Rekall to triage memory dumps - Recovering credentials, browser sessions, or open files from process memory

## Memory Acquisition

### Live Acquisition Tools

#### Windows

```powershell # WinPmem (Recommended) winpmem_mini_x64.exe memory.raw

# DumpIt DumpIt.exe

# Belkasoft RAM Capturer # GUI-based, outputs raw format

# Magnet RAM Capture # GUI-based, outputs raw format ```

#### Linux

```bash # LiME (Linux Memory Extractor) sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions) sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format) sudo cp /proc/kcore memory.elf ```

#### macOS

```bash # osxpmem sudo ./osxpmem -o memory.raw

# MacQuisition (commercial) ```

### Virtual Machine Memory

```bash # VMware: .vmem file is raw memory cp vm.vmem memory.raw

# VirtualBox: Use debug console vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU virsh dump <domain> memory.raw --memory-only

# Hyper-V # Checkpoint contains memory state ```

## Detailed section: Volatility 3 Framework

Originally a 2680-byte section in this SKILL.md. Moved to `references/details.md` to fit Codex's 8 KB skill body cap.

## Analysis Workflows

### Malware Analysis Workflow

```bash # 1. Initial process survey vol -f memory.raw windows.pstree > processes.txt vol -f memory.raw windows.pslist > pslist.txt

# 2. Network connections vol -f memory.raw windows.netscan > network.txt

# 3. Detect injection vol -f memory.raw windows.malfind > malfind.txt

# 4. Analyze suspicious processes vol -f memory.raw windows.dlllist --pid <PID> vol -f memory.raw windows.handles --pid <PID>

# 5. Dump suspicious executables vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. Extract strings from dumps strings -a pid.<PID>.exe > strings.txt

# 7. YARA scanning vol -f memory.raw windows.yarascan --yara-rules malware.yar ```

### Incident Response Workflow

```bash # 1. Timeline of events vol -f memory.raw windows.timeliner > timeline.csv

# 2. User activity vol -f memory.raw windows.cmdline vol -f memory.raw windows.consoles

# 3. Persistence mechanisms vol -f memory.raw windows.registry.printkey \ --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. Services vol -f memory.raw windows.svcscan

# 5. Scheduled tasks vol -f memory.raw windows.scheduled_tasks

# 6. Recent files vol -f memory.raw windows.filescan | grep -i "recent" ```

## Data Structures

### Windows Process Structures

```c // EPROCESS (Executive Process) typedef struct _EPROCESS { KPROCESS Pcb; // Kernel process block EX_PUSH_LOCK ProcessLock; LARGE_INTEGER CreateTime; LARGE_INTEGER ExitTime; // ... LIST_ENTRY ActiveProcessLinks; // Doubly-linked list ULONG_PTR UniqueProcessId; // PID // ... PEB* Peb; // Process Environment Block // ... } EPROCESS;

// PEB (Process Environment Block) typedef struct _PEB { BOOLEAN InheritedAddressSpace; BOOLEAN ReadImageFileExecOptions; BOOLEAN BeingDebugged; // Anti-debug check // ... PVOID ImageBaseAddress; // Base address of executable PPEB_LDR_DATA Ldr; // Loader data (DLL list) PRTL_USER_PROCESS_PARAMETERS ProcessParameters; // ... } PEB; ```

### VAD (Virtual Address Descriptor)

```c typedef struct _MMVAD { MMVAD_SHORT Core; union { ULONG LongFlags; MMVAD_FLAGS VadFlags; } u; // ... PVOID FirstPrototypePte; PVOID LastContiguousPte; // ... PFILE_OBJECT FileObject; } MMVAD;

// Memory protection flags #define PAGE_EXECUTE 0x10 #define PAGE_EXECUTE_READ 0x20 #define PAGE_EXECUTE_READWRITE 0x40 #define PAGE_EXECUTE_WRITECOPY 0x80 ```

## Detection Patterns

### Process Injection Indicators

```python # Malfind indicators # - PAGE_EXECUTE_READWRITE protection (suspicious) # - MZ header in non-image VAD region # - Shellcode patterns at allocation start

# Common injection techniques # 1. Classic DLL Injection # - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. Process Hollowing # - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC Injection # - QueueUserAPC targeting alertable threads

# 4. Thread Execution Hijacking # - SuspendThread + SetThreadContext + ResumeThread ```

### Rootkit Detection

```bash # Compare process lists vol -f memory.raw windows.pslist > pslist.txt vol -f memory.raw windows.psscan > psscan.txt diff pslist.txt psscan.txt # Hidden processes

# Check for DKOM (Direct Kernel Object Manipulation) vol -f memory.raw windows.callbacks

# Detect hooked functions vol -f memory.raw windows.ssdt # System Service Descriptor Table

# Driver analysis vol -f memory.raw windows.driverscan vol -f memory.raw windows.driverirp ```

### Credential Extraction

```bash # Dump hashes (requires hivelist first) vol -f memory.raw windows.hashdump

# LSA secrets vol -f memory.raw windows.lsadump

# Cached domain credentials vol -f memory.raw windows.cachedump

# Mimikatz-style extraction # Requires specific plugins/tools ```

## YARA Integration

### Writing Memory YARA Rules

```yara rule Suspicious_Injection { meta: description = "Detects common injection shellcode"

strings: // Common shellcode patterns $mz = { 4D 5A } $shellcode1 = { 55 8B EC 83 EC } // Function prologue $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 } // Push hash, call

condition: $mz at 0 or any of ($shellcode*) }

rule Cobalt_Strike_Beacon { meta: description = "Detects Cobalt Strike beacon in memory"

strings: $config = { 00 01 00 01 00 02 } $sleep = "sleeptime" $beacon = "%s (admin)" wide

condition: 2 of them } ```

### Scanning Memory

```bash # Scan all process memory vol -f memory.raw windows.yarascan --yara-rules rules.yar

# Scan specific process vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# Scan kernel memory vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel ```

## String Analysis

### Extracting Strings

```bash # Basic string extraction strings -a memory.raw > all_strings.txt

# Unicode strings strings -el memory.raw >> all_strings.txt

# Targeted extraction from process dump vol -f memory.raw windows.memmap --pid 1234 --dump strings -a pid.1234.dmp > process_strings.txt

# Pattern matching grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt ```

### FLOSS for Obfuscated Strings

```bash # FLOSS extracts obfuscated strings floss malware.exe > floss_output.txt

# From memory dump floss pid.1234.dmp ```

## Best Practices

### Acquisition Best Practices

1. **Minimize footprint**: Use lightweight acquisition tools 2. **Document everything**: Record time, tool, and hash of capture 3. **Verify integrity**: Hash memory dump immediately after capture 4. **Chain of custody**: Maintain proper forensic handling

### Analysis Best Practices

1. **Start broad**: Get overview before deep diving 2. **Cross-reference**: Use multiple plugins for same data 3. **Timeline correlation**: Correlate memory findings with disk/network 4. **Document findings**: Keep detailed notes and screenshots 5. **Validate results**: Verify findings through multiple methods

### Common Pitfalls

- **Stale data**: Memory is volatile, analyze promptly - **Incomplete dumps**: Verify dump size matches expected RAM - **Symbol issues**: Ensure correct symbol files for OS version - **Smear**: Memory may change during acquisition - **Encryption**: Some data may be encrypted in memory

Intended uses

• Performing memory analysis during incident response or breach investigation
• Extracting malware artifacts (processes, injected code, network connections) from a RAM capture
• Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown
• Using Volatility 3 / Rekall to triage memory dumps
• Recovering credentials, browser sessions, or open files from process memory