Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
yaklang avatar

Memory Forensics Volatility

yaklang/hack-skills

  • 2.2k installs
  • 1.5k repo stars
  • Updated June 16, 2026
  • yaklang/hack-skills

memory-forensics-volatility is an agent skill that Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detect

About

The memory-forensics-volatility skill. Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis. MEMORY ACQUISITION ### Linux ### Windows ### Virtual Machines --- ## 2. ANALYSIS METHODOLOGY ### Step 1: Identify OS ### Step 2: Process Listing - Hidden Process Detection **Red flags**: Process in but not = DKOM (Direct Kernel Object Manipulation) hiding. LINUX MEMORY ANALYSIS ### Building Linux Profiles (Vol2) --- ## 5. The workflow follows the source SKILL.md contract with progressive reference loading, clear trigger phrases, and practical steps developers can apply directly in agent sessions.

  • [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) for correlating network artifacts with memory findings
  • [steganography-techniques](../steganography-techniques/SKILL.md) if hidden data suspected in extracted files
  • [windows-privilege-escalation](../windows-privilege-escalation/SKILL.md) for understanding post-exploitation artifacts i
  • Vol2 vs Vol3 command comparison table
  • Common plugin sequences for specific investigation types

Memory Forensics Volatility by the numbers

  • 2,244 all-time installs (skills.sh)
  • +121 installs in the week ending Aug 5, 2026 (Skillselion tracking)
  • Ranked #265 of 2,203 Security skills by installs in the Skillselion catalog
  • Security screen: HIGH risk (skills.sh audit)
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
At a glance

memory-forensics-volatility capabilities & compatibility

Capabilities
[traffic analysis pcap](../traffic analysis pcap · [steganography techniques](../steganography tech · [windows privilege escalation](../windows privil · vol2 vs vol3 command comparison table · common plugin sequences for specific investigati
Use cases
documentation · planning · orchestration
From the docs

What memory-forensics-volatility says it does

Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis.
SKILL.md
npx skills add https://github.com/yaklang/hack-skills --skill memory-forensics-volatility

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs2.2k
repo stars★ 1.5k
Security audit1 / 3 scanners passed
Last updatedJune 16, 2026
Repositoryyaklang/hack-skills ↗

How do I apply memory-forensics-volatility correctly using the SKILL.md workflows and reference files?

Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response time

Who is it for?

Developers and software engineers working with memory-forensics-volatility patterns from the skill documentation.

Skip if: Skip when cached docs are empty, boilerplate-only, or outside the skill documented scope.

When should I use this skill?

Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.

What you get

Grounded memory-forensics-volatility guidance with highlights, triggers, and evidence quotes from SKILL.md.

  • Process and network analysis report
  • Credential and injection findings
  • Incident response timeline

By the numbers

  • Supports Volatility 2 and Volatility 3 analysis workflows

Files

SKILL.mdMarkdownGitHub ↗

SKILL: Memory Forensics — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert memory forensics techniques using Volatility 2 and 3. Covers memory acquisition, OS identification, process analysis (hidden process detection), network connections, DLL/module analysis, code injection detection (malfind), credential extraction, file carving, registry analysis, and timeline generation. Base models miss the Vol2/Vol3 command differences, malware indicator patterns, and Linux-specific memory analysis.

0. RELATED ROUTING

Before going deep, consider loading:

  • traffic-analysis-pcap for correlating network artifacts with memory findings
  • steganography-techniques if hidden data suspected in extracted files
  • windows-privilege-escalation for understanding post-exploitation artifacts in memory

Quick Reference

Also load VOLATILITY_CHEATSHEET.md when you need:

  • Vol2 vs Vol3 command comparison table
  • Common plugin sequences for specific investigation types

---

1. MEMORY ACQUISITION

Linux

# LiME (Linux Memory Extractor) — kernel module
insmod lime.ko "path=/tmp/mem.lime format=lime"

# /proc/kcore (if available)
dd if=/proc/kcore of=/tmp/mem.raw bs=1M

# AVML (Microsoft's open-source)
./avml /tmp/mem.lime

Windows

# WinPmem
winpmem_mini_x64.exe memdump.raw

# FTK Imager (GUI) — capture memory to file

# DumpIt (single-click memory dump)
DumpIt.exe

# Comae (MagnetRAM)
MagnetRAMCapture.exe /output memdump.raw

Virtual Machines

# VMware: .vmem file in VM directory (suspend VM first)
# VirtualBox: VBoxManage debugvm "VM_NAME" dumpvmcore --filename mem.raw
# KVM/QEMU: virsh dump DOMAIN memdump --memory-only
# Hyper-V: checkpoint VM → inspect .bin files

---

2. VOLATILITY 2 vs 3

ConceptVolatility 2Volatility 3
Profile system--profile=Win10x64_19041Auto-detected (symbol tables)
Image infoimageinfowindows.info / linux.info
Process listpslistwindows.pslist
Networknetscan / connectionswindows.netscan / windows.netstat
DLLsdlllistwindows.dlllist
Injectionmalfindwindows.malfind
Hasheshashdumpwindows.hashdump
Filesfilescanwindows.filescan
Registryhivelist / printkeywindows.registry.hivelist / windows.registry.printkey
Installpip2 install volatilitypip3 install volatility3

---

3. ANALYSIS METHODOLOGY

Step 1: Identify OS

# Vol2
vol.py -f mem.raw imageinfo
vol.py -f mem.raw kdbgscan

# Vol3
vol -f mem.raw windows.info
vol -f mem.raw banners.Banners

Step 2: Process Listing — Hidden Process Detection

# Vol2
vol.py -f mem.raw --profile=PROFILE pslist       # EPROCESS linked list
vol.py -f mem.raw --profile=PROFILE psscan       # pool tag scan (finds unlinked)
vol.py -f mem.raw --profile=PROFILE pstree       # parent-child hierarchy

# Vol3
vol -f mem.raw windows.pslist
vol -f mem.raw windows.psscan
vol -f mem.raw windows.pstree

Red flags: Process in psscan but not pslist = DKOM (Direct Kernel Object Manipulation) hiding.

Step 3: Network Connections

# Vol2
vol.py -f mem.raw --profile=PROFILE netscan      # TCP/UDP endpoints
vol.py -f mem.raw --profile=PROFILE connections   # XP/2003 only
vol.py -f mem.raw --profile=PROFILE connscan      # closed connections

# Vol3
vol -f mem.raw windows.netscan
vol -f mem.raw windows.netstat

Step 4: DLL / Module Analysis

# Vol2
vol.py -f mem.raw --profile=PROFILE dlllist -p PID
vol.py -f mem.raw --profile=PROFILE ldrmodules -p PID   # find unlinked DLLs

# Vol3
vol -f mem.raw windows.dlllist --pid PID

Red flags: DLL in dlllist but False in all three ldrmodules columns = reflective DLL injection.

Step 5: Code Injection Detection (Malfind)

# Vol2
vol.py -f mem.raw --profile=PROFILE malfind -p PID
vol.py -f mem.raw --profile=PROFILE malfind -D /tmp/dump/   # dump injected sections

# Vol3
vol -f mem.raw windows.malfind --pid PID

What malfind detects: Memory regions with PAGE_EXECUTE_READWRITE that don't map to a file on disk — classic shellcode/injection indicator.

Step 6: Credential Extraction

# Vol2
vol.py -f mem.raw --profile=PROFILE hashdump      # SAM hashes
vol.py -f mem.raw --profile=PROFILE lsadump       # LSA secrets
vol.py -f mem.raw --profile=PROFILE cachedump     # domain cached creds
vol.py -f mem.raw --profile=PROFILE mimikatz      # (plugin) plaintext creds

# Vol3
vol -f mem.raw windows.hashdump
vol -f mem.raw windows.lsadump
vol -f mem.raw windows.cachedump

Step 7: File Extraction

# Vol2
vol.py -f mem.raw --profile=PROFILE filescan | grep -i "password\|secret\|flag"
vol.py -f mem.raw --profile=PROFILE dumpfiles -Q OFFSET -D /tmp/dump/

# Vol3
vol -f mem.raw windows.filescan
vol -f mem.raw windows.dumpfiles --virtaddr OFFSET

Step 8: Registry Analysis

# Vol2
vol.py -f mem.raw --profile=PROFILE hivelist
vol.py -f mem.raw --profile=PROFILE printkey -K "Software\Microsoft\Windows\CurrentVersion\Run"
vol.py -f mem.raw --profile=PROFILE userassist    # program execution evidence

# Vol3
vol -f mem.raw windows.registry.hivelist
vol -f mem.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"

Step 9: Command History

# Vol2
vol.py -f mem.raw --profile=PROFILE cmdscan       # cmd.exe history
vol.py -f mem.raw --profile=PROFILE consoles       # full console output

# Vol3
vol -f mem.raw windows.cmdline

Step 10: Timeline Generation

# Vol2
vol.py -f mem.raw --profile=PROFILE timeliner --output=body --output-file=timeline.body
mactime -b timeline.body -d > timeline.csv

# Vol3
vol -f mem.raw timeliner.Timeliner

---

4. LINUX MEMORY ANALYSIS

# Vol2 (requires Linux profile)
vol.py -f mem.lime --profile=LinuxProfile linux_pslist
vol.py -f mem.lime --profile=LinuxProfile linux_pstree
vol.py -f mem.lime --profile=LinuxProfile linux_netstat
vol.py -f mem.lime --profile=LinuxProfile linux_bash        # bash history
vol.py -f mem.lime --profile=LinuxProfile linux_enumerate_files
vol.py -f mem.lime --profile=LinuxProfile linux_proc_maps -p PID
vol.py -f mem.lime --profile=LinuxProfile linux_malfind

# Vol3
vol -f mem.lime linux.pslist
vol -f mem.lime linux.pstree
vol -f mem.lime linux.bash
vol -f mem.lime linux.check_afinfo     # rootkit detection
vol -f mem.lime linux.check_syscall    # syscall hooking
vol -f mem.lime linux.tty_check        # TTY hooking

Building Linux Profiles (Vol2)

cd volatility/tools/linux
make
# Creates module.dwarf + System.map → zip as profile
zip LinuxProfile.zip module.dwarf /boot/System.map-$(uname -r)
# Place in volatility/plugins/overlays/linux/

---

5. MALWARE INDICATORS IN MEMORY

IndicatorDetection MethodWhat It Means
Process in psscan but not pslistCompare pslist vs psscanDKOM — process hiding
Unexpected parent-childpstree analysise.g., svchost spawned by cmd.exe
MZ header in non-image memorymalfindReflective DLL / PE injection
RWX memory without backing filemalfindShellcode injection
DLL unlinked from all PEB listsldrmodules (all False)Stealth DLL loading
svchost.exe not child of services.exepstreeFake svchost (malware)
Unusual network connectionsnetscan + PID correlationC2 communication
Hooking in SSDT/IDTssdt / idt pluginsRootkit
Modified kernel objectslinux_check_syscallLinux rootkit

Normal Parent-Child Relationships (Windows)

System (4)
└── smss.exe
    └── csrss.exe
    └── wininit.exe
        └── services.exe
            └── svchost.exe (multiple)
            └── spoolsv.exe
        └── lsass.exe
    └── winlogon.exe
        └── explorer.exe
            └── user applications

---

6. DECISION TREE

Memory dump acquired — need to analyze
│
├── What OS?
│   ├── Windows → vol imageinfo / windows.info (§3 Step 1)
│   └── Linux → build profile or use Vol3 auto-detect (§4)
│
├── Malware investigation?
│   ├── Check processes: pslist vs psscan (hidden?) (§3 Step 2)
│   ├── Check parent-child: pstree (suspicious spawning?) (§5)
│   ├── Check injections: malfind (RWX memory?) (§3 Step 5)
│   ├── Check DLLs: ldrmodules (unlinked?) (§3 Step 4)
│   ├── Check network: netscan (C2 connections?) (§3 Step 3)
│   └── Extract suspicious files: dumpfiles (§3 Step 7)
│
├── Credential recovery?
│   ├── SAM hashes → hashdump (§3 Step 6)
│   ├── LSA secrets → lsadump (§3 Step 6)
│   ├── Cached domain creds → cachedump (§3 Step 6)
│   └── Plaintext passwords → mimikatz plugin (§3 Step 6)
│
├── Incident timeline?
│   ├── timeliner for comprehensive timeline (§3 Step 10)
│   ├── cmdscan / consoles for command history (§3 Step 9)
│   ├── userassist for program execution (§3 Step 8)
│   └── Cross-reference with PCAP timeline (→ traffic-analysis-pcap)
│
├── CTF / flag hunting?
│   ├── filescan + grep for flag patterns (§3 Step 7)
│   ├── cmdscan for typed flags/passwords (§3 Step 9)
│   ├── Clipboard: clipboard plugin
│   ├── Screenshots: screenshot plugin
│   └── Environment vars: envars plugin
│
└── Linux-specific?
    ├── linux_bash for shell history (§4)
    ├── linux_check_syscall for rootkit (§4)
    └── linux_netstat for connections (§4)

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

How it compares

Pick memory-forensics-volatility over generic IR checklists when a RAM dump is available and Volatility-specific plugin selection is the analysis bottleneck.

FAQ

Who is memory-forensics-volatility for?

Developers and software engineers working with memory-forensics-volatility patterns from the skill documentation.

When should I use memory-forensics-volatility?

Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.

Is memory-forensics-volatility safe to install?

Review the Security Audits panel on this page before installing in production.

Securityaudit
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.