Self-hosted alternatives to memory-forensics

M

memory-forensics

Master memory forensics techniques including memory acquisition

memory-forensics is an agent skill from the wshobson/agents collection that covers memory forensics: acquiring, analyzing and extracting artifacts from memory dumps, for incident response and malware analysis. Memory forensics looks at the contents of RAM, which can hold running processes, injected code, open network connections and sometimes credentials or open files that never reached the disk. The skill covers acquiring volatile memory from a live Windows, Linux or macOS system before it is shut down, the live acquisition tools for each platform, and analysis of a captured memory image with Volatility 3, Rekall and related tools. It applies when investigating a breach or performing memory analysis during incident response, extracting malware artifacts such as processes, injected code and network connections from a RAM capture, triaging memory dumps, and recovering browser sessions or open files from process memory. The skill is oriented to defenders and analysts who are responding to an incident on systems they are authorized to examine, and the work should follow the organization's incident response and evidence-handling procedures. It is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 10.8K installs. At the time of the scan, Gen Agent Trust Hub and Snyk passed, and Socket showed a warning.