AutoGineer
Generated banner for Memory Forensics
Generated logo for Memory Forensics

Memory Forensics

Seth HobsonCommunityCreated by Dávid BalatoniDistributed by Seth Hobson

  • Skill
  • Tool integration
  • Security
  • MIT
  • Low risk
Download ZIP

From the author

Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.
— the description by Dávid Balatoni

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a comprehensive guide to memory forensics, covering the entire lifecycle from volatile memory acquisition to advanced analysis. It focuses on using the Volatility 3 framework to investigate system states, detect malware, and extract artifacts from Windows, Linux, and macOS memory dumps. The content includes practical workflows for incident response, process injection detection, and credential extraction, supported by technical details on Windows memory structures and YARA rule integration.

What it does

  • Guides the acquisition of volatile memory from Windows, Linux, and macOS systems.
  • Provides workflows for analyzing process trees, network connections, and system artifacts.
  • Details techniques for detecting code injection, rootkits, and persistence mechanisms.
  • Explains how to extract credentials and browser sessions from memory dumps.
  • Demonstrates the use of YARA rules to scan memory for malicious patterns.
  • Offers best practices for maintaining chain of custody and verifying data integrity.

When to use it

  • During active incident response or security breach investigations.
  • When performing deep-dive malware analysis on RAM captures.
  • To recover forensic artifacts like open files or command-line history.
  • When auditing system integrity for hidden processes or kernel-level hooks.

Advantages

  • Standardizes the memory forensics process using the industry-standard Volatility framework.
  • Includes platform-specific commands for Windows, Linux, and macOS.
  • Provides actionable detection patterns for common injection techniques.
  • Covers both live acquisition and post-mortem analysis workflows.

Usage examples

“How do I list all running processes from a Windows memory dump using Volatility 3?”
The agent provides the command 'vol -f memory.raw windows.pslist' and explains how to interpret the output for process identification.
“What are the steps to detect process injection in a memory capture?”
The agent outlines a workflow using the 'windows.malfind' plugin and explains how to inspect VAD protections and memory headers.
“How can I extract network connections from a Linux memory dump?”
The agent provides the command 'vol -f memory.raw linux.sockstat' to list active network sockets and connections.
“Show me how to scan a memory dump for Cobalt Strike beacons using YARA.”
The agent provides a sample YARA rule for Cobalt Strike and the corresponding 'windows.yarascan' command to execute the scan.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/wshobson/memory-forensics/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip memory-forensics.zip -d .agents/skills

Documentation by Dávid Balatoni

Memory Forensics

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

When to Use This Skill

  • Performing memory analysis during incident response or breach investigation

  • Extracting malware artifacts (processes, injected code, network connections) from a RAM capture

  • Acquiring volatile memory from a live Windows/Linux/macOS system before shutdown

  • Using Volatility 3 / Rekall to triage memory dumps

  • Recovering credentials, browser sessions, or open files from process memory

Memory Acquisition

Live Acquisition Tools
Windows
# WinPmem (Recommended)
winpmem_mini_x64.exe memory.raw

# DumpIt
DumpIt.exe

# Belkasoft RAM Capturer
# GUI-based, outputs raw format

# Magnet RAM Capture
# GUI-based, outputs raw format
Linux
# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf
macOS
# osxpmem
sudo ./osxpmem -o memory.raw

# MacQuisition (commercial)
Virtual Machine Memory
# VMware: .vmem file is raw memory
cp vm.vmem memory.raw

# VirtualBox: Use debug console
vboxmanage debugvm "VMName" dumpvmcore --filename memory.elf

# QEMU
virsh dump <domain> memory.raw --memory-only

# Hyper-V
# Checkpoint contains memory state

Detailed section: Volatility 3 Framework

Originally a 2680-byte section in this SKILL.md. Moved to references/details.md to fit Codex's 8 KB skill body cap.

Analysis Workflows

Malware Analysis Workflow
# 1. Initial process survey
vol -f memory.raw windows.pstree > processes.txt
vol -f memory.raw windows.pslist > pslist.txt

# 2. Network connections
vol -f memory.raw windows.netscan > network.txt

# 3. Detect injection
vol -f memory.raw windows.malfind > malfind.txt

# 4. Analyze suspicious processes
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.handles --pid <PID>

# 5. Dump suspicious executables
vol -f memory.raw windows.pslist --pid <PID> --dump

# 6. Extract strings from dumps
strings -a pid.<PID>.exe > strings.txt

# 7. YARA scanning
vol -f memory.raw windows.yarascan --yara-rules malware.yar
Incident Response Workflow
# 1. Timeline of events
vol -f memory.raw windows.timeliner > timeline.csv

# 2. User activity
vol -f memory.raw windows.cmdline
vol -f memory.raw windows.consoles

# 3. Persistence mechanisms
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# 4. Services
vol -f memory.raw windows.svcscan

# 5. Scheduled tasks
vol -f memory.raw windows.scheduled_tasks

# 6. Recent files
vol -f memory.raw windows.filescan | grep -i "recent"

Data Structures

Windows Process Structures
// EPROCESS (Executive Process)
typedef struct _EPROCESS {
    KPROCESS Pcb;                    // Kernel process block
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    // ...
    LIST_ENTRY ActiveProcessLinks;   // Doubly-linked list
    ULONG_PTR UniqueProcessId;       // PID
    // ...
    PEB* Peb;                        // Process Environment Block
    // ...
} EPROCESS;

// PEB (Process Environment Block)
typedef struct _PEB {
    BOOLEAN InheritedAddressSpace;
    BOOLEAN ReadImageFileExecOptions;
    BOOLEAN BeingDebugged;           // Anti-debug check
    // ...
    PVOID ImageBaseAddress;          // Base address of executable
    PPEB_LDR_DATA Ldr;              // Loader data (DLL list)
    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
    // ...
} PEB;
VAD (Virtual Address Descriptor)
typedef struct _MMVAD {
    MMVAD_SHORT Core;
    union {
        ULONG LongFlags;
        MMVAD_FLAGS VadFlags;
    } u;
    // ...
    PVOID FirstPrototypePte;
    PVOID LastContiguousPte;
    // ...
    PFILE_OBJECT FileObject;
} MMVAD;

// Memory protection flags
#define PAGE_EXECUTE           0x10
#define PAGE_EXECUTE_READ      0x20
#define PAGE_EXECUTE_READWRITE 0x40
#define PAGE_EXECUTE_WRITECOPY 0x80

Detection Patterns

Process Injection Indicators
# Malfind indicators
# - PAGE_EXECUTE_READWRITE protection (suspicious)
# - MZ header in non-image VAD region
# - Shellcode patterns at allocation start

# Common injection techniques
# 1. Classic DLL Injection
#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread

# 2. Process Hollowing
#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory

# 3. APC Injection
#    - QueueUserAPC targeting alertable threads

# 4. Thread Execution Hijacking
#    - SuspendThread + SetThreadContext + ResumeThread
Rootkit Detection
# Compare process lists
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
diff pslist.txt psscan.txt  # Hidden processes

# Check for DKOM (Direct Kernel Object Manipulation)
vol -f memory.raw windows.callbacks

# Detect hooked functions
vol -f memory.raw windows.ssdt  # System Service Descriptor Table

# Driver analysis
vol -f memory.raw windows.driverscan
vol -f memory.raw windows.driverirp
Credential Extraction
# Dump hashes (requires hivelist first)
vol -f memory.raw windows.hashdump

# LSA secrets
vol -f memory.raw windows.lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump

# Mimikatz-style extraction
# Requires specific plugins/tools

YARA Integration

Writing Memory YARA Rules
rule Suspicious_Injection
{
    meta:
        description = "Detects common injection shellcode"

    strings:
        // Common shellcode patterns
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // Function prologue
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // Push hash, call

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory"

    strings:
        $config = { 00 01 00 01 00 02 }
        $sleep = "sleeptime"
        $beacon = "%s (admin)" wide

    condition:
        2 of them
}
Scanning Memory
# Scan all process memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar

# Scan specific process
vol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234

# Scan kernel memory
vol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel

String Analysis

Extracting Strings
# Basic string extraction
strings -a memory.raw > all_strings.txt

# Unicode strings
strings -el memory.raw >> all_strings.txt

# Targeted extraction from process dump
vol -f memory.raw windows.memmap --pid 1234 --dump
strings -a pid.1234.dmp > process_strings.txt

# Pattern matching
grep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt
FLOSS for Obfuscated Strings
# FLOSS extracts obfuscated strings
floss malware.exe > floss_output.txt

# From memory dump
floss pid.1234.dmp

Best Practices

Acquisition Best Practices

  1. Minimize footprint: Use lightweight acquisition tools

  2. Document everything: Record time, tool, and hash of capture

  3. Verify integrity: Hash memory dump immediately after capture

  4. Chain of custody: Maintain proper forensic handling

Analysis Best Practices

  1. Start broad: Get overview before deep diving

  2. Cross-reference: Use multiple plugins for same data

  3. Timeline correlation: Correlate memory findings with disk/network

  4. Document findings: Keep detailed notes and screenshots

  5. Validate results: Verify findings through multiple methods

Common Pitfalls

  • Stale data: Memory is volatile, analyze promptly

  • Incomplete dumps: Verify dump size matches expected RAM

  • Symbol issues: Ensure correct symbol files for OS version

  • Smear: Memory may change during acquisition

  • Encryption: Some data may be encrypted in memory

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Dávid Balatoni
Publisher
Seth Hobson (Community)
Distributed by
Seth Hobson
Source
wshobson/agents · plugins/reverse-engineering/skills/memory-forensics · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Dávid Balatoni or Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download memory-forensics.zip