Description
memory-forensics is an agent skill from the wshobson/agents collection that covers memory forensics: acquiring, analyzing and extracting artifacts from memory dumps, for incident response and malware analysis. Memory forensics looks at the contents of RAM, which can hold running processes, injected code, open network connections and sometimes credentials or open files that never reached the disk. The skill covers acquiring volatile memory from a live Windows, Linux or macOS system before it is shut down, the live acquisition tools for each platform, and analysis of a captured memory image with Volatility 3, Rekall and related tools. It applies when investigating a breach or performing memory analysis during incident response, extracting malware artifacts such as processes, injected code and network connections from a RAM capture, triaging memory dumps, and recovering browser sessions or open files from process memory. The skill is oriented to defenders and analysts who are responding to an incident on systems they are authorized to examine, and the work should follow the organization's incident response and evidence-handling procedures. It is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 10.8K installs. At the time of the scan, Gen Agent Trust Hub and Snyk passed, and Socket showed a warning.…
Highlights
- Live memory acquisition on Windows, Linux and macOS
- Analysis of memory dumps with Volatility 3 and Rekall
- Malware artifact extraction
- Process and network connection analysis
- Incident response triage
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate memory-forensics.
People also visit
memory-forensics FAQ
What is memory forensics?
Examining a computer's RAM to find running processes, injected code, network connections and other artifacts.
Which tools does it use?
Volatility 3 and Rekall, along with live acquisition tools for each operating system.
When is it used?
During incident response and malware analysis, and when a live system must be captured before shutdown.
Is it only for authorized systems?
It is written for analysts responding to incidents on systems they are authorized to examine, and should follow the organization's evidence procedures.
How do I install it?
Run npx skills add https://github.com/wshobson/agents --skill memory-forensics.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Warn and Snyk Pass. A Warn or Fail is worth reading before you install.
What are the best memory-forensics alternatives?
Popular alternatives to memory-forensics include on-call-handoff-patterns, sre-engineer and debugging-and-error-recovery. See all memory-forensics alternatives