skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

collecting-volatile-evidence-from-compromised-host

Collect volatile forensic evidence from compromised hosts following RFC 3227 order of volatility.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#memory forensics#chain of custody#DFIR#memory acquisition#rootkit detection#volatile evidence
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill collecting-volatile-evidence-from-compromised-host
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: collecting-volatile-evidence-from-compromised-host
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/collecting-volatile-evidence-from-compromised-host
Command: npx skills add https://github.com/xalgord/xalgorix --skill collecting-volatile-evidence-from-compromised-host

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a security incident is confirmed, critical evidence like memory contents, network connections, and running processes disappears the moment a system is shut down or remediated. This Skill guides the correct collection of volatile forensic evidence before it is lost, while maintaining chain of custody for legal admissibility.

Core Features & Use Cases

  • Order-of-Volatility Workflow: Captures memory first (WinPmem, LiME, osxpmem), then network state, processes, sessions, and system configuration, following RFC 3227.
  • Anti-Rootkit Validation: Compares host-reported state against memory image analysis to detect rootkits that hide processes and connections from standard tools.
  • Evidence Integrity & Chain of Custody: Generates SHA256 manifests and chain-of-custody documentation for every collected artifact.
  • Use Case: A fileless PowerShell malware attack is detected on a Windows server. Use this Skill to dump RAM before shutdown, capture active C2 connections and process trees, hash all artifacts, and produce court-ready evidence documentation.

Quick Start

Collect volatile forensic evidence from the compromised host, starting with a memory dump and then capturing network connections, running processes, and logged-in sessions with SHA256 hashing and chain of custody documentation.

Frequently Asked Questions about collecting-volatile-evidence-from-compromised-host

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect volatile evidence from a compromised host?▼

Follow the order of volatility in RFC 3227: capture the memory image first using WinPmem or LiME, then collect network connections, running processes, logged-in users, and system configuration. Hash every artifact with SHA256 immediately after collection.

What tools are used for memory acquisition in incident response?▼

WinPmem handles Windows memory acquisition, LiME is a Linux kernel module for memory dumps, and osxpmem covers macOS. Sysinternals tools like listdlls and handle capture process and file-handle state on Windows.

Why should memory be captured before running netstat or tasklist?▼

Every command executed on a live host allocates memory and overwrites freed pages, destroying evidence needed for fileless malware analysis. Capturing the RAM image first preserves the most volatile data before live-state commands alter it.

Can I trust netstat and ps output on a compromised system?▼

No, rootkits hook host binaries like ps, netstat, and lsof to hide malicious processes and connections. Run trusted tools from external media and compare host-reported state against the memory image to detect discrepancies.

What is chain of custody in digital forensics?▼

Chain of custody is documentation tracking who collected evidence, when, how, and where it is stored, from collection through court presentation. This Skill generates a chain-of-custody record alongside a SHA256 manifest of all collected artifacts.

When should I pull the plug instead of doing live forensic collection?▼

Live collection is preferred because encrypted volumes (BitLocker, LUKS) are readable while mounted and memory holds the keys. Pulling the plug is only justified when the host is actively destroying data.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

alert

Generate structured SOC alert triage steps and SIEM/EDR queries.

Community
Intermediate
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced