skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Memory Forensics (Volatility 3 / Memory Baseliner)

Analyze Windows memory images with Volatility 3 to detect hidden processes and anomalies.

1|Updated Apr 25, 2026
Search Tags:#code injection#baseline comparison#memory forensics#DFIR#volatility 3#process anomaly#network triage
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill memory-forensics-volatility-3-memory-baseliner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Memory Forensics (Volatility 3 / Memory Baseliner)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/memory-analysis
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill memory-forensics-volatility-3-memory-baseliner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Memory images often contain concealed processes, injected code, and historical network/service activity that aren’t visible from disk alone, making incident triage slow and incomplete.

Core Features & Use Cases

  • Hidden process and anomaly discovery: Use Volatility 3 to enumerate processes and highlight discrepancies (psscan vs pslist), then expand into parent-child, command-line, tokens/privileges, handles, and loaded DLLs to explain suspicious activity.
  • Code injection and artifact extraction: Identify RWX/VAD anomalies and suspicious memory regions (malfind, vadinfo, vadyarascan), then dump relevant files and process memory for deeper inspection.
  • Baseline-based deviation detection: Compare suspect images against a known-good JSON baseline (processes, drivers, services) using Memory Baseliner to focus analyst attention on what truly changed.

Quick Start

Run Volatility 3 memory analysis as root on your image to produce process, network, injection, and extraction artifacts: use the memory-analysis skill with your Windows memory image path, then follow its recommended plugin sequence to write outputs into the analysis and exports directories.

Frequently Asked Questions about Memory Forensics (Volatility 3 / Memory Baseliner)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden processes in a Windows memory image during DFIR triage?▼

To find hidden processes during DFIR triage, compare Volatility 3 psscan against pslist results to reveal discrepancies, then expand into parent-child relationships, command-lines, and loaded DLLs to explain suspicious activity.

What is the best way to detect code injection in Volatility 3 memory forensics?▼

Detecting code injection in Volatility 3 memory forensics involves using malfind, vadinfo, and vadyarascan to identify RWX memory anomalies and suspicious regions, allowing you to dump process memory for deeper artifact inspection.

Can I compare a suspect memory image against a known-good baseline to find anomalies?▼

You can compare suspect memory images against a known-good JSON baseline using Memory Baseliner to detect deviations in processes, drivers, and services, focusing analyst attention on exactly what changed in the environment.

How do I extract historical network and service indicators from a memory image?▼

Extract historical network and service indicators from a memory image by running Volatility 3 plugins to enumerate network artifacts and service activity, capturing historical traces not visible from disk analysis alone.

Do I need root privileges to run Volatility 3 for memory analysis?▼

Yes, running Volatility 3 memory analysis as root is required to ensure elevated execution, correct plugin paths, proper symbol handling, and deterministic rendering of outputs into analysis and exports directories.

Why does my Volatility 3 analysis fail to enumerate processes correctly?▼

Volatility 3 process enumeration fails when symbol handling is incorrect or execution privileges are insufficient; ensuring root access and valid symbol paths resolves plugin sequence errors and allows accurate psscan and pslist comparison.

Related Skills

Explore More Data & Analytics Skills→
Sumeet138Sumeet138
1

memory-forensics

Extract artifacts from Windows, Linux, and macOS memory dumps using Volatility 3.

Community
Advanced
YukiIto1999YukiIto1999

extracting-memory-artifacts-with-rekall

Analyze memory dumps with Rekall to identify indicators of compromise.

Community
Advanced
jassicsjassics
6

forensic-triage

Automate forensic triage by collecting disk, memory, and log evidence to build an incident timeline.

Community
Advanced
mqzkimmqzkim

health-monitor

Monitor real-time availability, response times, and error rates of services.

Community
Intermediate