Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Performing Memory Forensics with Volatility 3 · mukul975 | DecimalAI

Performing Memory Forensics With Volatility3

SkillScore17Maintained

performing-memory-forensics-with-volatility3

Analyze volatile memory dumps using Volatility 3 to extract running processes, network connections, loaded modules, and evidence of malicious activity.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-memory-forensics-with-volatility3/SKILL.md

decimalai skills pull performing-memory-forensics-with-volatility3 --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-memory-forensics-with-volatility3/SKILL.md https://app.decimal.ai/s/performing-memory-forensics-with-volatility3/SKILL.md

Raw file: /s/performing-memory-forensics-with-volatility3/SKILL.md ↗ · machine-readable summary at /s/performing-memory-forensics-with-volatility3.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +13% lift · at higher cost+276% tokens0% turns17% of whole cases pass with skill (4/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-09	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—
case-11	✗→✓	▲ Improved	—	—
case-12	✓→✓	＝ Same ✓	—	—
case-05	✗→✗	＝ Same ✗	—	—

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-memory-forensics-with-volatility3/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Performing Memory Forensics with Volatility 3

When to Use

When analyzing a RAM dump from a compromised or suspect system
During incident response to identify running malware, injected code, or rootkits
When you need to extract credentials, encryption keys, or network connections from memory
For detecting process hollowing, DLL injection, or hidden processes
When disk-based forensics alone is insufficient and volatile data is critical

Prerequisites

Python 3.7+ installed
Volatility 3 framework installed (pip install volatility3)
Memory dump in raw, ELF, or crash dump format
Appropriate symbol tables (ISF files) for the target OS version
Sufficient disk space for analysis output (2-3x memory dump size)
Optional: YARA rules for malware scanning in memory

Workflow

Step 1: Acquire Memory Dump and Install Volatility 3

bash
# Install Volatility 3
pip install volatility3

# Or install from source for latest features
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
pip install -e .

# Download Windows symbol tables (ISF packs)
# Place in volatility3/symbols/ directory
wget https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
unzip windows.zip -d /opt/volatility3/volatility3/symbols/

# Download Linux and Mac symbol packs
wget https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
wget https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip

# Memory acquisition tools (for live systems):
# Windows: winpmem, DumpIt, FTK Imager
# Linux: LiME (Linux Memory Extractor)
sudo insmod lime-$(uname -r).ko "path=/cases/memory/linux_mem.lime format=lime"

# Verify the memory dump
file /cases/case-2024-001/memory/memory.raw
ls -lh /cases/case-2024-001/memory/memory.raw

Step 2: Identify the Operating System Profile

bash
# Run banners plugin to identify the OS
vol -f /cases/case-2024-001/memory/memory.raw banners

# For Windows, identify the OS version
vol -f /cases/case-2024-001/memory/memory.raw windows.info

# Output example:
# Variable        Value
# Kernel Base     0xf8047e200000
# DTB             0x1ad000
# Symbols         ntkrnlmp.pdb/GUID
# Is64Bit         True
# IsPAE           False
# primary layer   Intel32e
# KdVersionBlock  0xf8047ee232c0
# Major/Minor     15.19041
# Machine Type    34404
# KeNumberProcessors 4
# SystemTime      2024-01-18 14:32:15 UTC
# NtBuildLab      19041.1.amd64fre.vb_release.191206-1406
# NtProductType   NtProductWinNt
# NtSystemRoot    C:\WINDOWS
# PE MajorOperatingSystemVersion 10
# PE MinorOperatingSystemVersion 0

# For Linux memory dumps
vol -f /cases/case-2024-001/memory/linux_mem.lime linux.info

Step 3: Enumerate Processes and Detect Anomalies

bash
# List all running processes
vol -f /cases/case-2024-001/memory/memory.raw windows.pslist | tee /cases/case-2024-001/analysis/pslist.txt

# Show process tree (parent-child relationships)
vol -f /cases/case-2024-001/memory/memory.raw windows.pstree | tee /cases/case-2024-001/analysis/pstree.txt

# Detect hidden processes using cross-view analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.psscan | tee /cases/case-2024-001/analysis/psscan.txt

# Compare pslist vs psscan to find hidden processes
diff <(vol -f memory.raw windows.pslist | awk '{print $1}' | sort) \
     <(vol -f memory.raw windows.psscan | awk '{print $1}' | sort)

# List DLLs loaded by a suspicious process (PID 4532)
vol -f /cases/case-2024-001/memory/memory.raw windows.dlllist --pid 4532

# Check for process hollowing and injection
vol -f /cases/case-2024-001/memory/memory.raw windows.malfind | tee /cases/case-2024-001/analysis/malfind.txt

# Dump suspicious process memory for further analysis
vol -f /cases/case-2024-001/memory/memory.raw windows.memmap --pid 4532 --dump \
   -o /cases/case-2024-001/analysis/dumps/

Step 4: Analyze Network Connections and Registry

bash
# List active network connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | tee /cases/case-2024-001/analysis/netscan.txt

# Filter for established connections
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep ESTABLISHED

# Filter for listening ports
vol -f /cases/case-2024-001/memory/memory.raw windows.netscan | grep LISTENING

# Extract network connections with process mapping
vol -f /cases/case-2024-001/memory/memory.raw windows.netstat | tee /cases/case-2024-001/analysis/netstat.txt

# Dump registry hives from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.hivelist

# Extract specific registry keys
vol -f /cases/case-2024-001/memory/memory.raw windows.registry.printkey \
   --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Check services
vol -f /cases/case-2024-001/memory/memory.raw windows.svcscan | tee /cases/case-2024-001/analysis/services.txt

Step 5: Extract Credentials and Sensitive Data

bash
# Dump cached credentials (hashdump)
vol -f /cases/case-2024-001/memory/memory.raw windows.hashdump | tee /cases/case-2024-001/analysis/hashes.txt

# Extract LSA secrets
vol -f /cases/case-2024-001/memory/memory.raw windows.lsadump

# Dump cached domain credentials
vol -f /cases/case-2024-001/memory/memory.raw windows.cachedump

# Search for plaintext strings in process memory
vol -f /cases/case-2024-001/memory/memory.raw windows.strings --pid 4532 \
   | grep -iE '(password|credential|token|api.key)'

# Extract command history from cmd.exe/powershell
vol -f /cases/case-2024-001/memory/memory.raw windows.cmdline | tee /cases/case-2024-001/analysis/cmdline.txt

# Extract environment variables
vol -f /cases/case-2024-001/memory/memory.raw windows.envars --pid 4532

Step 6: Scan for Malware with YARA Rules

bash
# Scan memory with YARA rules
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
   --yara-file /opt/yara-rules/malware_index.yar | tee /cases/case-2024-001/analysis/yara_hits.txt

# Scan specific process memory
vol -f /cases/case-2024-001/memory/memory.raw yarascan \
   --yara-file /opt/yara-rules/apt_rules.yar --pid 4532

# Check loaded kernel modules for rootkits
vol -f /cases/case-2024-001/memory/memory.raw windows.modules | tee /cases/case-2024-001/analysis/modules.txt

# Detect unlinked/hidden modules
vol -f /cases/case-2024-001/memory/memory.raw windows.modscan | tee /cases/case-2024-001/analysis/modscan.txt

# Check for SSDT hooks (System Service Descriptor Table)
vol -f /cases/case-2024-001/memory/memory.raw windows.ssdt | grep -v "ntoskrnl\|win32k"

# Dump a suspicious executable from memory
vol -f /cases/case-2024-001/memory/memory.raw windows.dumpfiles --pid 4532 \
   -o /cases/case-2024-001/analysis/extracted/

Step 7: Compile Findings into a Report

bash
# Generate comprehensive analysis summary
echo "=== MEMORY FORENSICS REPORT ===" > /cases/case-2024-001/analysis/memory_report.txt
echo "Image: memory.raw" >> /cases/case-2024-001/analysis/memory_report.txt
echo "OS: Windows 10 Build 19041" >> /cases/case-2024-001/analysis/memory_report.txt
echo "" >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- Suspicious Processes ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/malfind.txt >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- Network Connections ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/netscan.txt >> /cases/case-2024-001/analysis/memory_report.txt

echo "--- YARA Matches ---" >> /cases/case-2024-001/analysis/memory_report.txt
cat /cases/case-2024-001/analysis/yara_hits.txt >> /cases/case-2024-001/analysis/memory_report.txt

# Calculate hash of the memory dump for integrity
sha256sum /cases/case-2024-001/memory/memory.raw >> /cases/case-2024-001/analysis/memory_report.txt

Key Concepts

| Concept | Description | |---------|-------------| | Volatile data | Information that exists only in RAM and is lost when power is removed | | Process hollowing | Technique where malware replaces legitimate process memory with malicious code | | DLL injection | Loading unauthorized DLLs into a running process address space | | EPROCESS | Windows kernel structure representing a process; basis for process listing | | Pool scanning | Searching memory for kernel object signatures to find hidden artifacts | | VAD (Virtual Address Descriptor) | Memory management structure tracking process virtual memory regions | | ISF (Intermediate Symbol Format) | Volatility 3 symbol table format for OS-specific structure definitions | | Malfind | Plugin detecting injected code by examining VAD permissions and content |

Tools & Systems

| Tool | Purpose | |------|---------| | Volatility 3 | Primary open-source memory forensics framework | | LiME | Linux Memory Extractor for acquiring Linux RAM dumps | | WinPmem | Windows physical memory acquisition driver | | DumpIt | Comae one-click Windows memory dump utility | | YARA | Pattern matching engine for malware signature scanning | | Rekall | Alternative memory forensics framework (Google) | | MemProcFS | Memory process file system for memory analysis | | strings | Extract printable strings from binary memory dumps |

Common Scenarios

Scenario 1: Active Malware Investigation Acquire memory with DumpIt, run pslist/pstree to identify suspicious processes, use malfind to detect injected code in svchost.exe, dump the injected memory segment, scan with YARA rules identifying Cobalt Strike beacon, extract C2 IP from netscan, correlate with network logs.

Scenario 2: Credential Theft After Breach Run hashdump and lsadump to extract cached credentials, identify mimikatz execution in cmdline output, check for lsass.exe memory dumps in filesystem artifacts, correlate with lateral movement evidence in network connections.

Scenario 3: Rootkit Detection Compare pslist (uses EPROCESS linked list) with psscan (pool scanning) to find unlinked processes, check modules vs modscan for hidden kernel drivers, examine SSDT for hooks redirecting system calls, dump suspicious modules for static analysis.

Scenario 4: Ransomware Incident Recovery Extract encryption keys from ransomware process memory before system shutdown, identify the ransomware variant using YARA, find the initial execution point through command line artifacts, map lateral movement via network connections.

Output Format

Memory Forensics Analysis:
  Image:            memory.raw (16 GB)
  OS Identified:    Windows 10 x64 Build 19041
  Capture Time:     2024-01-18 14:32:15 UTC

  Process Analysis:
    Total Processes:    87
    Hidden Processes:   2 (PIDs: 4532, 6128)
    Injected Processes: 3 (malfind detections)
    Suspicious:         svchost.exe (PID 4532) - injected code at 0x7FFE0000

  Network Connections:
    Total:        45
    Established:  12
    Suspicious:   3 (C2 connections to 185.xx.xx.xx:443)

  Credentials Found:
    NTLM Hashes:      4 accounts
    Cached Creds:      2 domain accounts

  YARA Matches:
    CobaltStrike_Beacon:  PID 4532 (3 hits)
    Mimikatz_Memory:      PID 6128 (1 hit)

  Extracted Artifacts:   15 files dumped to /analysis/extracted/

Illustrative Want to see what performing-memory-forensics-with-volatility3 would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 10:55 UTC · 23 cases

Lift

+13%

17% vs 4%

Agent turns

1.0 vs 1.0

Tokens

+276%

4,401.86 vs 1,169.45

fail → pass · 3pass → pass · 1fail → fail · 19

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-05 To identify active command-and-control sockets in a Windows 10 memory capture `mem.raw`, an analyst attempts to run `windows.netstat`, but it yields incomplete results for closed or historical network pools. Which Volatility 3 plugin scans physical memory pools for socket and connection structures across all network states?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 You are analyzing a Windows physical memory dump `mem.raw` using Volatility 3. A colleague suggests running `vol -f mem.raw imageinfo` as used in older versions, but this command fails. Which Volatility 3 plugin should you execute to retrieve OS build, kernel base address, and system architecture metadata?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 We need to deploy continuous, real-time file integrity monitoring and process execution blocking across 500 Windows endpoints. Which Volatility 3 command or daemon mode should be deployed on endpoints for real-time EDR blocking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When analyzing an unknown binary memory image without knowing whether it is Linux, macOS, or Windows, which top-level Volatility 3 plugin searches memory for OS kernel banners?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 API keys or secret tokens are frequently stored in environment variables of a running application. Which Volatility 3 plugin extracts environment variables for PID 1044?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We have an offline NTFS disk image `disk.img` from an infected host. The incident responder needs to create a log2timeline / plaso bodyfile of MFT file creation, modification, and access timestamps across the entire partition. How should Volatility 3 be configured to parse the MFT off disk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 You suspect shellcode was injected into `svchost.exe` via process hollowing. You want to inspect Virtual Address Descriptor (VAD) regions for executable permissions without corresponding disk backing. Which Volatility 3 plugin is designed specifically for detecting injected memory regions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 To identify system call interception by legacy rootkits in a Windows memory dump, an analyst checks the System Service Descriptor Table. Which Volatility 3 plugin lists SSDT entries, and how do you filter out standard Windows kernel modules like `ntoskrnl.exe` and `win32k.sys`?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During an incident response investigation, an attacker rootkit unlinked a malicious process from the active process list (`ActiveProcessLinks`). Which Volatility 3 plugin scans memory pools directly to locate unlinked EPROCESS structures, and how are its results compared with standard process listing to spot hidden processes?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Instead of dumping raw memory pages, an investigator wants to extract executable files associated with PID 4532 from memory onto disk at `/cases/out/`. Which Volatility 3 plugin should be used?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 To recover LSA secrets (such as service account passwords or auto-logon credentials) stored in memory, which Volatility 3 plugin should be executed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We collected a 5 GB Wireshark network packet capture (`capture.pcap`) from our perimeter firewall during a suspected breach. How do we use Volatility 3 to extract HTTP POST payloads and TLS certificate chains from this PCAP file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 You are examining a Linux RAM dump captured via LiME named `linux.lime`. Which Volatility 3 plugin identifies basic kernel and operating system release details for Linux images?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 A kernel-mode rootkit has removed its driver entry from the loaded module list. Which Volatility 3 plugin scans pool memory to discover unlinked or hidden driver structures, contrasting with `windows.modules`?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Our SOC flagged abnormal network egress coming from an endpoint. I've placed the system memory dump at `/cases/case-882/ram.raw`. Work through a full Volatility 3 volatile memory analysis workflow on this file. Inspect process hierarchies, check for injected code or hidden processes, inspect active connections, extract command history/credentials, and run YARA detection rules. Provide an executive summary report listing image metadata, operating system release details, total/hidden/injected process counts, C2 network connections, credential findings, YARA match signatures, and dumped artifact locations.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 You need to extract local account NTLM password hashes directly from an offline Windows memory image using Volatility 3. Which plugin performs this extraction?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An incident response team captured an uncompressed physical RAM dump (`raw_dump.dmp`) from a compromised system and needs to perform non-live post-mortem process injection and credential extraction analysis. What open-source framework is the standard for extracting kernel structures, VAD maps, network sockets, and credentials from physical RAM images?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An investigator wants to check all DLLs loaded by process ID 2048 to see if an unauthorized DLL was injected into its address space. Which Volatility 3 command line achieves this?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An adversary executed PowerShell commands on a compromised machine prior to memory capture. Which Volatility 3 plugin extracts command-line arguments and process invocation parameters from process memory?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 You have a custom YARA rule file located at `/opt/rules/cobaltstrike.yar`. How do you execute a YARA scan against a complete memory image `mem.raw` in Volatility 3, and how do you restrict that scan to PID 3104?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 An analyst wants to check persistence in the Windows Registry hive from a memory dump. They need to display the values under `Software\Microsoft\Windows\CurrentVersion\Run`. Which Volatility 3 plugin and parameter should be used?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 You identified suspicious process PID 4532 containing shellcode. What Volatility 3 command extracts and dumps the memory map pages for PID 4532 into `/tmp/dumps/`?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When setting up Volatility 3, symbol tables are required for structure definitions. What is the file format used by Volatility 3 for symbol files, and where are OS symbol packs downloaded from Volatility placed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 22 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +13 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.4%
Pass rate with the skill: 17.4%
Cases attempted: 23
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 10:55 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run17

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+203% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.