Skip to content
Get packs

Memory Forensics with Volatility

Guides an agent through analysing RAM dumps with Volatility 3 to find malware, injection and credential theft.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a structured incident-response workflow for analysing a computer's memory (RAM) dump. It explains how to acquire memory, identify the operating system, review running and hidden processes, check network connections, detect injected code with malfind, and pull out credential-related artifacts using the Volatility 3 tool. It then helps assemble a forensic report of findings.

Great for

  • Incident responders and DFIR analysts investigating an endpoint that was contained during an active incident
  • Security students learning how memory forensics workflows are structured
  • Analysts who already have Volatility 3 and a RAM capture and want a checklist of commands and indicators

Skip it if

  • Disk image or file system analysis, which the skill itself says should use tools like Autopsy or FTK (wrong tool for the evidence type)
  • Live production systems without authorisation, since memory acquisition and dumping credential-related data can be sensitive and legally restricted
  • Users expecting a fully automated verdict; the indicators are heuristics and results need expert review to avoid false conclusions

Try asking

  • “I have a RAM dump from WKSTN-042. Walk me through a Volatility 3 triage for process injection.”
  • “Check this memory image for hidden processes and suspicious network connections to external IPs.”
  • “Help me write the forensic report template for my memory analysis findings, including IOCs and YARA matches.”
  • “What Volatility 3 plugins should I run to look for credential theft such as LSASS dumping?”
Step-by-step guide: how to use Memory Forensics with VolatilityInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-memory-forensics-with-volatility.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-memory-forensics-with-volatility.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-memory-forensics-with-volatility.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Verify the SHA-256 hash and document chain of custody for every dump before analysis, so evidence remains defensible.
  • Compare pslist with psscan output and cross-check suspicious connections against the process tree rather than relying on a single plugin.
  • Run the analysis on an isolated analyst workstation and only on dumps you are authorised to examine.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.