Skills
.Work. You
Rest

detecting-rootkit-activity

Community

Detect rootkit activity via memory forensics.

Software Engineering#malware-analysis#memory-forensics#volatility3#rootkit#kernel-hooks#cross-view
AuthorYukiIto1999
Version1.0.0
Installs0

System Documentation

What problem does it solve?

Identify and characterize kernel-level rootkits that hide processes, files, and network activity by integrating memory-forensics results with cross-view verification to reveal hidden components and covert communications.

Core Features & Use Cases

  • Cross-view detection of hidden processes via Volatility pslist vs psscan
  • SSDT/driver hook and DKOM analysis for kernel-level stealth
  • Hidden files and registry/service discovery
  • Memory-based network activity correlation to uncover covert channels

Quick Start

Analyze a memory dump with Volatility 3 and run the rootkit detection agent to generate a cross-view integrity report.

Dependency Matrix

Required Modules

None required

Components

scriptsreferences

💻 Claude Code Installation

Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.

Please help me install this Skill:
Name: detecting-rootkit-activity
Download link: https://github.com/YukiIto1999/ctf-sleuth/archive/main.zip#detecting-rootkit-activity

Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
View Source Repository

Agent Skills Search Helper

Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.