Skip to content
Get packs

Volatile Evidence Collection from Compromised Hosts

Guides an agent through capturing memory, network state and running processes from a compromised machine before they are lost.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent follows a step-by-step incident-response procedure for collecting short-lived forensic evidence from a machine suspected of compromise. It starts with the most fragile data (RAM, live network connections, running processes, logged-in sessions, system configuration) and records each item with timestamps and hashes so a documented chain of custody is kept. It also includes Python scripts that automate parts of the collection.

Great for

  • Incident responders and security analysts handling a confirmed or suspected host compromise
  • Teams that need forensic evidence strong enough for legal, HR or insider-threat cases
  • Students or trainees learning the order of volatility and live response practice

Skip it if

  • Routine system administration or troubleshooting: the commands capture sensitive data and change nothing in a helpful way for everyday fixes
  • Running on a production machine without authorization, since memory capture and process inspection expose private data and may breach policy or law
  • Anyone expecting a turnkey tool: it requires external forensic binaries (WinPmem, LiME, Sysinternals) and a trusted USB toolkit that must be prepared in advance

Try asking

  • “Help me collect volatile evidence from a Linux server we suspect has fileless malware, following order of volatility.”
  • “Walk me through capturing memory, network connections and running processes from this Windows host before we isolate it.”
  • “Generate a chain-of-custody log and SHA256 hashes for evidence collected from a compromised workstation.”
  • “Map the collection steps to NIST CSF incident response controls for our post-incident report.”
Step-by-step guide: how to use Volatile Evidence Collection from Compromised HostsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    collecting-volatile-evidence-from-compromised-host.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip collecting-volatile-evidence-from-compromised-host.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip collecting-volatile-evidence-from-compromised-host.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the scripts from a trusted external toolkit, not from software installed on the compromised host, and verify tool hashes first.
  • Obtain written authorization and legal or HR sign-off before collecting, especially for insider cases; review every command before running it as root or Administrator.
  • Keep the output folder off the suspect machine and record a case ID so the collection log stays consistent with your chain-of-custody forms.

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.