Linux Memory Forensics with LiME and Volatility
Guides an agent through capturing Linux RAM with LiME and analysing it with Volatility 3 for incident response.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent can follow a structured procedure for investigating a compromised Linux machine. It explains how to capture a copy of the system's live memory using the LiME kernel module, then uses Volatility 3 to pull out running processes, network connections, bash command history, loaded kernel modules and suspicious injected code. A bundled Python helper can run these steps and collect the output, so the agent can organise findings rather than only describing commands.
Great for
- Incident responders examining a suspected compromised Linux server in a lab or authorised setting
- Security students learning memory forensics workflows with LiME and Volatility 3
- SOC analysts who want a repeatable checklist for Linux memory triage
Skip it if
- Production systems without authorisation or a plan: loading a kernel module with insmod changes the running system and can crash it or alter evidence
- Windows or macOS memory analysis, since the skill covers only Linux
- Anyone expecting a fully verified tool: the content is a generic procedure and the commands and file paths are not validated against specific Volatility or LiME versions
Try asking
- “Walk me through capturing memory from this Linux host with LiME and what to check first.”
- “Use Volatility 3 to list processes and compare them with psscan to find hidden ones in this memory image.”
- “Extract bash history and open network sockets from memory.lime for my incident report.”
- “Check loaded kernel modules in this memory dump for signs of a rootkit.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-memory-forensics-with-lime-and-volatility.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-memory-forensics-with-lime-and-volatility.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-memory-forensics-with-lime-and-volatility.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run acquisition only in an authorised lab or on systems you are permitted to investigate, and record hashes of the evidence file.
- Review the scripts/agent.py commands before running it, since it calls insmod and executes vol3 with shell-free subprocess arguments.
- Cross-check plugin output against your own tooling, because the skill does not document which Volatility 3 versions it was tested with.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.