0138-memory-forensics
CommunityTurn RAM dumps into actionable forensic evidence.
Education & Research#incident response#yara#malware analysis#memory forensics#process injection#volatility3#ram dump
AuthorMrJmpl3
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This Skill solves the challenge of extracting reliable forensic artifacts from volatile memory so you can investigate intrusions, malware behavior, and incident timelines using repeatable workflows.
Core Features & Use Cases
- Memory acquisition guidance: Captures RAM from Windows/Linux/macOS and common virtualization platforms to produce usable dump formats for analysis.
- Volatility 3 workflows: Guides analysis of processes, network activity, injected code, DLLs/modules, registry artifacts, and file system objects.
- Detection and enrichment: Covers common process-injection indicators, rootkit and credential extraction workflows, YARA scanning, and string extraction/obfuscation handling.
Quick Start
Run Volatility 3 against your dump to generate an initial process overview and triage suspicious activity from RAM.
Dependency Matrix
Required Modules
None requiredComponents
Standard package💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: 0138-memory-forensics Download link: https://github.com/MrJmpl3/codex_____data_____configuration/archive/main.zip#0138-memory-forensics Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.