Memory Forensics Analysis
FreeAnalyze Linux memory with LiME and Volatility.
Free · Opens the source repo
What Memory Forensics Analysis does
The Analyzing Memory Forensics with LiME and Volatility skill is designed for security professionals and incident responders who need to perform in-depth memory analysis on compromised Linux systems. By leveraging the LiME (Linux Memory Extractor) kernel module, users can acquire memory images that contain critical forensic artifacts. Once the memory has been captured, the skill utilizes the Volatility 3 framework to analyze these images, extracting valuable information such as process lists, network connections, bash history, and loaded kernel modules.
This skill is particularly useful in scenarios where security incidents have occurred, and there is a need to investigate potential breaches or malicious activities. It provides structured procedures for extracting and analyzing memory data, making it easier for SOC analysts to build detection rules or threat-hunting queries tailored to specific attack techniques. The combination of LiME and Volatility enables a comprehensive approach to memory forensics, allowing for a thorough examination of the state of a Linux system at the time of acquisition.
To effectively use this skill, users should have a solid understanding of security operations and access to a safe testing environment. The skill requires Python 3.8 or higher along with the necessary dependencies, ensuring that users can execute the provided commands and scripts without issues. The instructions guide users through the process of memory acquisition and subsequent analysis, making it straightforward to follow and implement.
In summary, this skill is an essential tool for cybersecurity professionals focused on incident response and memory forensics, providing the necessary capabilities to extract and analyze critical data from compromised Linux systems.
When to use it
Use this skill when conducting memory forensics during security incident investigations or when validating security monitoring coverage.
When not to use it
Avoid using this skill if you lack familiarity with security operations or do not have the appropriate authorization for testing activities.
What you can build with it
Incident Response Investigation
Use this skill to acquire and analyze memory from a compromised Linux system during an incident response investigation.
Building Detection Rules
Leverage the skill to extract forensic data that can help in constructing detection rules for future threat hunting.
Validating Security Monitoring Coverage
Utilize the analysis results to assess the effectiveness of existing security monitoring solutions in detecting memory-based attacks.
How to install Memory Forensics Analysis
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-memory-forensics-with-lime-and-volatility --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Memory Forensics with LiME and Volatility
When to Use
- When investigating security incidents that require analyzing memory forensics with lime and volatility
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Acquire Linux memory using LiME kernel module, then analyze with Volatility 3 to extract forensic artifacts from the memory image.
# LiME acquisition
insmod lime-$(uname -r).ko "path=/evidence/memory.lime format=lime"
# Volatility 3 analysis
vol3 -f /evidence/memory.lime linux.pslist
vol3 -f /evidence/memory.lime linux.bash
vol3 -f /evidence/memory.lime linux.sockstat
import volatility3
from volatility3.framework import contexts, automagic
from volatility3.plugins.linux import pslist, bash, sockstat
# Programmatic Volatility 3 usage
context = contexts.Context()
automagics = automagic.available(context)
Key analysis steps:
- Acquire memory with LiME (format=lime or format=raw)
- List processes with linux.pslist, compare with linux.psscan
- Extract bash command history with linux.bash
- List network connections with linux.sockstat
- Check loaded kernel modules with linux.lsmod for rootkits
Examples
# Full forensic workflow
vol3 -f memory.lime linux.pslist | grep -v "\[kthread\]"
vol3 -f memory.lime linux.bash
vol3 -f memory.lime linux.malfind
vol3 -f memory.lime linux.lsmod
Frequently asked questions about Memory Forensics Analysis
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.