Skip to content
Get packs

Memory Forensics

Guides an agent through acquiring and analyzing RAM dumps with Volatility for incident response and malware triage.

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
2 files

What it does

This skill gives an AI agent a reference playbook for investigating memory (RAM) captures from computers. Once installed, when you ask about analyzing a memory dump or investigating a possibly infected machine, the agent knows which tools to use to capture live memory, which Volatility 3 commands to run to list processes, network connections, injected code and persistence, and how to write and run YARA rules against memory. It is aimed at security professionals doing incident response or malware analysis.

Great for

  • Incident responders triaging a suspected compromised Windows, Linux or macOS machine
  • Malware analysts looking for injected code, hidden processes or extracted artifacts in RAM captures
  • Security students learning the standard Volatility 3 workflow

Skip it if

  • Casual users who just want to check a computer for viruses; this is an expert forensics workflow and the agent cannot verify results on its own
  • Investigations requiring legally admissible evidence without a trained examiner, since chain of custody and tool validation are not covered
  • Attacking or extracting credentials from systems you do not own or have authorization to examine, since the skill includes credential extraction commands (hashdump, lsadump, cachedump)

Try asking

  • “Walk me through triaging this memory.raw file from a suspected breach using Volatility 3”
  • “Which Volatility plugins should I run to find process injection in a Windows RAM capture?”
  • “Write a YARA rule to detect Cobalt Strike beacon strings in process memory”
  • “How do I acquire memory from a live Linux server with LiME before shutting it down?”
Step-by-step guide: how to use Memory ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    memory-forensics.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip memory-forensics.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip memory-forensics.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy of the memory image and record hashes so findings stay reproducible; the agent will not do this for you unless asked.
  • Ask for one workflow step at a time and review the commands before running them, especially those that dump or touch memory on live systems.
  • Check the Volatility plugin names against your installed Volatility 3 version, since the skill's examples may not match every release.

What's inside

  • references/details.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.