skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

memory-triage

Triage unknown memory images for compromise indicators across Windows, Linux, and macOS.

11|1|Updated May 4, 2026
Search Tags:#incident response#SANS#volatility#MITRE ATT&CK#memory forensics#memory triage#compromise detection
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill memory-triage-dreadnode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: memory-triage
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/memory-forensics/skills/memory-triage
Command: npx skills add https://github.com/dreadnode/capabilities --skill memory-triage-dreadnode

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Manually analyzing unknown memory images during security incidents is time-intensive and risks missing subtle compromise indicators, especially when under time pressure to scope an active breach.

Core Features & Use Cases

  • Standardized SANS 6-Step Workflow: Follows the industry-accepted FOR508/FOR526 memory triage methodology to ensure no critical analysis steps are missed.
  • Compromise Indicator Detection: Identifies hidden processes, code injection, suspicious network activity, and unauthorized persistence mechanisms across Windows, Linux, and macOS memory images.
  • Actionable Reporting: Maps all findings to MITRE ATT&CK and D3FEND frameworks to streamline incident reporting and detection backlog routing.
  • Use Case: An incident responder handed an unknown memory dump from a suspected ransomware attack can use this skill to quickly surface high-priority findings like injected code or hidden persistence to guide targeted follow-up analysis.

Quick Start

Use the memory-triage skill to perform a first-pass analysis of the provided unknown memory image and generate a prioritized triage report of potential compromise indicators.

Frequently Asked Questions about memory-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform memory forensics triage on an unknown memory image during incident response?▼

Memory forensics triage applies a structured first-pass analysis to unknown memory images, scanning process censuses, network artifacts, code injection, and persistence to identify signs of compromise. This skill standardizes the workflow using the SANS 6-step methodology.

What memory image formats are supported for compromise detection?▼

Compromise detection supports .mem, .raw, .vmem, .dmp, .lime, .bin, and .aff4 memory image formats across Windows, Linux, and macOS systems. This broad compatibility ensures you can triage memory dumps regardless of the target operating system.

How does memory triage map findings to MITRE ATT&CK and D3FEND frameworks?▼

Memory triage maps detected compromise indicators like hidden processes and unauthorized persistence directly to MITRE ATT&CK and D3FEND frameworks. This mapping streamlines incident reporting and routes findings into the detection backlog for actionable security responses.

Can I use this SANS methodology workflow for Linux and macOS memory dumps?▼

Yes, the SANS methodology workflow applies to Linux and macOS memory dumps alongside Windows images. It performs process census, network artifact analysis, code injection detection, and persistence checks across all three operating systems.

What is the best way to detect code injection and hidden processes in a memory dump?▼

The best way to detect code injection and hidden processes is running a standardized first-pass triage on the memory dump. This process identifies suspicious network activity and unauthorized persistence mechanisms by applying the SANS FOR508/FOR526 methodology.

Why use a standardized workflow for memory image analysis during a ransomware attack?▼

Using a standardized workflow for memory image analysis during a ransomware attack ensures no critical steps are missed when scoping an active breach under time pressure. It rapidly surfaces high-priority findings like injected code to guide targeted follow-up analysis.

Related Skills

Explore More Data & Analytics Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate
YukiIto1999YukiIto1999

performing-threat-hunting-with-yara-rules

Detect malware and indicators of compromise across filesystems and memory dumps with YARA rules.

Community
Advanced