Skip to content
Get packs

Guide · Agent skill

How to use the Memory Forensics with Volatility agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the conducting-memory-forensics-with-volatility agent skill, which guides an AI agent through analysing a computer's memory (RAM) dump with the Volatility 3 framework. It is written for incident responders, DFIR analysts and security students who may never have used an agent skill before. By the end you will know what the skill does, how to add it to your agent, how to ask for it in plain language and what it needs before it can run.

Memory Forensics with Volatilitymukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
  2. 2Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
  3. 3Prepare Volatility 3 and symbols. Install Volatility 3 so the vol command works, with Python 3 and the symbol tables the skill requires.
  4. 4Acquire the memory image. Capture RAM from an authorised, contained system with a tool such as WinPmem, Magnet RAM Capture, DumpIt or AVML, and record a hash and chain of custody.
  5. 5Ask for the analysis in plain language. Describe the case, name the dump file and say what you suspect, such as process injection or credential theft.
  6. 6Review the findings. Check each flagged process, connection and injected region against your baseline, and have an expert review the results.
  7. 7Assemble the forensic report. Ask the agent to compile the findings into a structured report with PIDs, connections, IOCs, YARA matches and credential exposure.

What does the skill make the agent do?

Once installed, the agent follows a structured incident-response workflow for a memory dump. The skill covers acquiring memory, identifying the operating system, reviewing running and hidden processes, checking network connections, detecting injected code with malfind, and pulling out credential-related artifacts. It then helps assemble a forensic report of findings.

The skill is aimed at evidence that exists only in RAM, such as process injection, fileless malware, network connections and encryption keys that are lost when a system is powered off. It is not a disk or file system tool.

  • Acquire a memory image with a forensically sound tool such as WinPmem, Magnet RAM Capture, DumpIt or AVML
  • Identify the OS and verify symbol information with Volatility 3
  • Compare process lists to find possibly hidden processes
  • Review network connections and cross-reference them with processes
  • Detect injected code and scan memory with YARA rules
  • Compile findings into a structured report

How do you install the skill?

Download the skill as a ZIP file from this page. Unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project.

If you use the Claude apps instead, you can upload the ZIP under Settings → Capabilities → Skills. Either way, the skill is loaded as a folder containing SKILL.md, a references/api-reference.md file and a scripts/agent.py file.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into .claude/skills/ inside the project folder
  • Claude apps: upload the ZIP under Settings → Capabilities → Skills

How do you trigger the skill with a natural request?

You do not need to name the skill. The skill description activates on requests about memory forensics, RAM analysis, the Volatility framework, memory dump investigation, volatile evidence analysis or live memory acquisition. Describe the situation and the evidence you have, and say what you want back.

Good requests state the case context and the file. Include the host name, the dump file and whether the system has already been contained, so the agent can follow the right steps.

  • "I have a RAM dump from WKSTN-042 taken after containment. Walk me through a Volatility 3 analysis for signs of process injection."
  • "Check memory.raw for hidden processes and suspicious network connections."
  • "We suspect Mimikatz or LSASS dumping on this endpoint. What can I confirm from the memory image?"
  • "Help me write a forensic report from the memory findings, including the IOCs we extracted."

What do you need before running it?

The skill lists its requirements. You need Volatility 3, invoked as vol, with Python 3 at the minimum release stated in the skill's prerequisites and the symbol tables it needs. You also need a memory acquisition tool, YARA rules for malware scanning, and storage equal to the RAM size of the target.

The skill also recommends a reference baseline of normal processes and DLLs for the OS version being analysed, and chain of custody documentation for evidence handling.

  • Volatility 3 (command: vol) with Python 3 and symbol tables
  • A memory acquisition tool: WinPmem, Magnet RAM Capture, DumpIt or AVML for Linux
  • YARA rules, for example Florian Roth's signature-base or your own rules
  • Free disk space at least equal to the system's RAM size per dump
  • A baseline of normal processes and DLLs, and chain of custody records
vol -f memory.raw windows.info

What does a typical analysis look like?

The agent works through the workflow in order. It starts by confirming the operating system, then lists processes and compares the process list with the scan results. Next it checks network connections, runs malfind on suspicious processes and, where relevant, scans with YARA.

Each command is a Volatility 3 plugin run against the same memory file. The skill's indicators, such as svchost.exe with the wrong parent or misspelled system process names, are prompts for investigation, not proof of compromise.

  • windows.pslist and windows.pstree for the process list and parent-child tree
  • windows.psscan to find processes that may be unlinked from the active list
  • windows.netscan to list connections with the owning process
  • windows.malfind to flag executable, non-file-backed memory regions
  • windows.yarascan with a rules file for signature matches
vol -f memory.raw windows.pslist vol -f memory.raw windows.psscan vol -f memory.raw windows.netscan vol -f memory.raw windows.malfind vol -f memory.raw windows.yarascan --yara-file malware_rules.yar

What safety and legal points should you know?

The skill runs scripts. Its scripts/agent.py file calls Volatility 3 through subprocess and parses the output. The skill does not use the network, according to its listing. Review the scripts before you run them on evidence, as you would with any tool.

Memory acquisition and credential-related dumping can be sensitive and legally restricted. Use the skill only on systems you are authorised to examine, and only on an endpoint that has been contained during an active incident. The skill itself points disk and file system analysis to tools such as Autopsy or FTK.

  • The skill runs scripts; review scripts/agent.py before use
  • The skill does not use the network, according to its listing
  • Use only on authorised systems; live production acquisition needs authorisation
  • Record chain of custody and the SHA-256 hash of each dump
  • Results are heuristics and need expert review before any conclusion

What tips help you get better results?

Verify the OS and symbols before trusting the rest of the output. Compare process lists rather than relying on one plugin, and treat every flagged process as a lead to check against your baseline.

Keep a written record of each command and its output. The skill suggests a report that includes process anomalies with PIDs and parent processes, network connections with process context, injected regions with memory protection flags, extracted IOCs, YARA matches and credential exposure.

  • Start with windows.info to confirm the OS and symbol source
  • Compare pslist with psscan to spot processes that may be hidden
  • Cross-check suspicious connections against the process tree
  • Note memory protection flags such as PAGE_EXECUTE_READWRITE on flagged regions
  • Keep a per-command log for the final report

What people use it for

  • Investigating an endpoint contained during an active incident to find injected code and suspicious connections
  • Checking whether a suspected Mimikatz or LSASS dumping event left evidence in memory
  • Teaching students how a memory forensics workflow is structured, step by step
  • Checking a RAM capture against a checklist of Volatility 3 commands and indicators
  • Recovering encryption keys or fileless malware artifacts before a system is shut down

Frequently asked questions

Is the Memory Forensics with Volatility agent skill free?

The skill is listed under the Apache-2.0 licence. Volatility 3 is described in the source as an open-source memory forensics framework. Check the licence files for the exact terms before reuse.

What do I need to install before using this skill?

You need Volatility 3 available as the vol command, Python 3 with symbol tables, a memory acquisition tool, YARA rules and enough storage for dumps the size of your RAM. The skill also expects chain of custody documentation.

How do I install an agent skill like this one?

Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

Can I use this skill for disk images or file system analysis?

No. The skill says disk image and file system work should use tools such as Autopsy or FTK. It is built for volatile memory evidence.

Does the skill give a final verdict that a machine is compromised?

No. The indicators it lists are heuristics, such as unusual parent processes or executable memory regions. Results need expert review before you draw a conclusion.

Which memory acquisition tool should I use with it?

The skill names WinPmem, Magnet RAM Capture, DumpIt and AVML for Linux. Use one that is appropriate for the target operating system and that you are authorised to run.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits incident responders, DFIR analysts and students who want a structured, command-level workflow for RAM analysis with Volatility 3. Pick something else if you need disk or file system forensics, a fully automated verdict, or if you cannot legally or policy-wise acquire and analyse memory from the system in question.

Download the skill