skills.rest
3xecutablefile
3xecutablefileCOMMUNITY
Explore all skills by this author →
GitHub

memory-forensics-volatility

Analyzes OSGi and non-OSGi memory dumps for MITRE ATT&CK techniques, generating detailed reports and Splunk dashboards from user-supplied text files and URLs without requiring a database or network connection.

Updated Aug 23, 2026
Search Tags:#volatility#memory forensics#process injection#credential extraction#incident timeline#malware triage#windows linux
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill memory-forensics-volatility-3xecutablefile
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-forensics-volatility
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/memory-forensics-volatility
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill memory-forensics-volatility-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Memory forensics playbooks using Volatility 2/3 eliminate guesswork when analyzing memory dumps for malware behavior, credential exposure, and incident timelines by providing consistent, OS-aware workflows.

Core Features & Use Cases

  • Volatility 2 vs 3 command execution: Run the right plugin set for the right engine and OS family (Windows/Linux) without mixing incompatible commands.
  • Hidden activity and injection detection: Identify DKOM-hidden processes, unlinked DLLs, and suspicious executable memory regions using pslist vs psscan comparisons plus malfind/ldrmodules workflows.
  • Rapid triage to deep investigation: Go from OS identification and process/network/DLL inspection to credential extraction, file carving, registry evidence, command history, and timeline reconstruction in a guided order.

Quick Start

Use the attached dump to identify the OS profile and start a triage by running imageinfo (Vol2) or windows.info (Vol3) to choose the correct subsequent plugins.

Frequently Asked Questions about memory-forensics-volatility

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect hidden processes and code injection when analyzing memory dumps?▼

Memory forensics detects hidden processes and code injection by comparing pslist against psscan to find DKOM-hidden activities, and using malfind with ldrmodules to identify suspicious executable memory regions and unlinked DLLs.

What is the proper workflow for extracting credentials and reconstructing incident timelines from memory?▼

Incident timeline reconstruction and credential extraction from memory require a coordinated plugin sequence: identify the OS profile first, inspect processes and network connections, then run targeted plugins to recover hashes, files, registry evidence, and command history.

Does memory forensics with Volatility work for both Windows and Linux dump analysis?▼

Memory forensics supports both Windows and Linux dump workflows by applying OS-aware plugin selection, ensuring you run the correct Volatility 2 or Volatility 3 commands for the specific operating system family without mixing incompatible tools.

What's the best way to start a Volatility triage on an unknown memory image?▼

Start memory forensics triage by running imageinfo in Volatility 2 or windows.info in Volatility 3 to identify the correct OS profile, which determines the appropriate subsequent plugins for process, network, and DLL inspection.

Why does comparing pslist and psscan matter during malware triage?▼

Comparing pslist and psscan matters during malware triage because discrepancies between the active process list and the scanned memory pool reveal DKOM-hidden processes, exposing rootkits or malicious activity attempting to evade standard detection.

When should I use Volatility 2 versus Volatility 3 for memory analysis?▼

Choose Volatility 2 or Volatility 3 based on OS profile compatibility and plugin availability; Volatility 3 is generally preferred for modern Windows analysis, while specific Linux dump workflows or legacy profiles may still require Volatility 2 plugins.

Related Skills

Explore More Education & Research Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
SherifEldeebSherifEldeeb
5

forensic-reporting

Generate formal forensic reports from investigation findings and evidence.

Community
Advanced
jaskaranhundaljaskaranhundal
3

forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

Community
Advanced
gl0bal01gl0bal01
44

malware-dynamic-analysis

Execute malware samples in sandboxes and capture runtime behavior with monitoring tools.

Community
Advanced