PaperclipOrg
Claude Agent Skill · by Wshobson

Memory Forensics

A comprehensive forensics skill that covers memory dump analysis with Volatility 3, from acquisition through artifact extraction. It walks you through the full

Install
Terminal · npx
$npx skills add https://github.com/wshobson/agents --skill memory-forensics
Works with Paperclip

How Memory Forensics fits into a Paperclip company.

Memory Forensics drops into any Paperclip agent that handles this kind of work. Assign it to a specialist inside a pre-configured PaperclipOrg company and the skill becomes available on every heartbeat — no prompt engineering, no tool wiring.

S
SaaS FactoryPaired

Pre-configured AI company — 18 agents, 18 skills, one-time purchase.

$27$59
Explore pack
Source file
SKILL.md483 lines
Expand
---name: memory-forensicsdescription: Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.--- # Memory Forensics Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis. ## Memory Acquisition ### Live Acquisition Tools #### Windows ```powershell# WinPmem (Recommended)winpmem_mini_x64.exe memory.raw # DumpItDumpIt.exe # Belkasoft RAM Capturer# GUI-based, outputs raw format # Magnet RAM Capture# GUI-based, outputs raw format``` #### Linux ```bash# LiME (Linux Memory Extractor)sudo insmod lime.ko "path=/tmp/memory.lime format=lime" # /dev/mem (limited, requires permissions)sudo dd if=/dev/mem of=memory.raw bs=1M # /proc/kcore (ELF format)sudo cp /proc/kcore memory.elf``` #### macOS ```bash# osxpmemsudo ./osxpmem -o memory.raw # MacQuisition (commercial)``` ### Virtual Machine Memory ```bash# VMware: .vmem file is raw memorycp vm.vmem memory.raw # VirtualBox: Use debug consolevboxmanage debugvm "VMName" dumpvmcore --filename memory.elf # QEMUvirsh dump <domain> memory.raw --memory-only # Hyper-V# Checkpoint contains memory state``` ## Volatility 3 Framework ### Installation and Setup ```bash# Install Volatility 3pip install volatility3 # Install symbol tables (Windows)# Download from https://downloads.volatilityfoundation.org/volatility3/symbols/ # Basic usagevol -f memory.raw <plugin> # With symbol pathvol -f memory.raw -s /path/to/symbols windows.pslist``` ### Essential Plugins #### Process Analysis ```bash# List processesvol -f memory.raw windows.pslist # Process tree (parent-child relationships)vol -f memory.raw windows.pstree # Hidden process detectionvol -f memory.raw windows.psscan # Process memory dumpsvol -f memory.raw windows.memmap --pid <PID> --dump # Process environment variablesvol -f memory.raw windows.envars --pid <PID> # Command line argumentsvol -f memory.raw windows.cmdline``` #### Network Analysis ```bash# Network connectionsvol -f memory.raw windows.netscan # Network connection statevol -f memory.raw windows.netstat``` #### DLL and Module Analysis ```bash# Loaded DLLs per processvol -f memory.raw windows.dlllist --pid <PID> # Find hidden/injected DLLsvol -f memory.raw windows.ldrmodules # Kernel modulesvol -f memory.raw windows.modules # Module dumpsvol -f memory.raw windows.moddump --pid <PID>``` #### Memory Injection Detection ```bash# Detect code injectionvol -f memory.raw windows.malfind # VAD (Virtual Address Descriptor) analysisvol -f memory.raw windows.vadinfo --pid <PID> # Dump suspicious memory regionsvol -f memory.raw windows.vadyarascan --yara-rules rules.yar``` #### Registry Analysis ```bash# List registry hivesvol -f memory.raw windows.registry.hivelist # Print registry keyvol -f memory.raw windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run" # Dump registry hivevol -f memory.raw windows.registry.hivescan --dump``` #### File System Artifacts ```bash# Scan for file objectsvol -f memory.raw windows.filescan # Dump files from memoryvol -f memory.raw windows.dumpfiles --pid <PID> # MFT analysisvol -f memory.raw windows.mftscan``` ### Linux Analysis ```bash# Process listingvol -f memory.raw linux.pslist # Process treevol -f memory.raw linux.pstree # Bash historyvol -f memory.raw linux.bash # Network connectionsvol -f memory.raw linux.sockstat # Loaded kernel modulesvol -f memory.raw linux.lsmod # Mount pointsvol -f memory.raw linux.mount # Environment variablesvol -f memory.raw linux.envars``` ### macOS Analysis ```bash# Process listingvol -f memory.raw mac.pslist # Process treevol -f memory.raw mac.pstree # Network connectionsvol -f memory.raw mac.netstat # Kernel extensionsvol -f memory.raw mac.lsmod``` ## Analysis Workflows ### Malware Analysis Workflow ```bash# 1. Initial process surveyvol -f memory.raw windows.pstree > processes.txtvol -f memory.raw windows.pslist > pslist.txt # 2. Network connectionsvol -f memory.raw windows.netscan > network.txt # 3. Detect injectionvol -f memory.raw windows.malfind > malfind.txt # 4. Analyze suspicious processesvol -f memory.raw windows.dlllist --pid <PID>vol -f memory.raw windows.handles --pid <PID> # 5. Dump suspicious executablesvol -f memory.raw windows.pslist --pid <PID> --dump # 6. Extract strings from dumpsstrings -a pid.<PID>.exe > strings.txt # 7. YARA scanningvol -f memory.raw windows.yarascan --yara-rules malware.yar``` ### Incident Response Workflow ```bash# 1. Timeline of eventsvol -f memory.raw windows.timeliner > timeline.csv # 2. User activityvol -f memory.raw windows.cmdlinevol -f memory.raw windows.consoles # 3. Persistence mechanismsvol -f memory.raw windows.registry.printkey \    --key "Software\Microsoft\Windows\CurrentVersion\Run" # 4. Servicesvol -f memory.raw windows.svcscan # 5. Scheduled tasksvol -f memory.raw windows.scheduled_tasks # 6. Recent filesvol -f memory.raw windows.filescan | grep -i "recent"``` ## Data Structures ### Windows Process Structures ```c// EPROCESS (Executive Process)typedef struct _EPROCESS {    KPROCESS Pcb;                    // Kernel process block    EX_PUSH_LOCK ProcessLock;    LARGE_INTEGER CreateTime;    LARGE_INTEGER ExitTime;    // ...    LIST_ENTRY ActiveProcessLinks;   // Doubly-linked list    ULONG_PTR UniqueProcessId;       // PID    // ...    PEB* Peb;                        // Process Environment Block    // ...} EPROCESS; // PEB (Process Environment Block)typedef struct _PEB {    BOOLEAN InheritedAddressSpace;    BOOLEAN ReadImageFileExecOptions;    BOOLEAN BeingDebugged;           // Anti-debug check    // ...    PVOID ImageBaseAddress;          // Base address of executable    PPEB_LDR_DATA Ldr;              // Loader data (DLL list)    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;    // ...} PEB;``` ### VAD (Virtual Address Descriptor) ```ctypedef struct _MMVAD {    MMVAD_SHORT Core;    union {        ULONG LongFlags;        MMVAD_FLAGS VadFlags;    } u;    // ...    PVOID FirstPrototypePte;    PVOID LastContiguousPte;    // ...    PFILE_OBJECT FileObject;} MMVAD; // Memory protection flags#define PAGE_EXECUTE           0x10#define PAGE_EXECUTE_READ      0x20#define PAGE_EXECUTE_READWRITE 0x40#define PAGE_EXECUTE_WRITECOPY 0x80``` ## Detection Patterns ### Process Injection Indicators ```python# Malfind indicators# - PAGE_EXECUTE_READWRITE protection (suspicious)# - MZ header in non-image VAD region# - Shellcode patterns at allocation start # Common injection techniques# 1. Classic DLL Injection#    - VirtualAllocEx + WriteProcessMemory + CreateRemoteThread # 2. Process Hollowing#    - CreateProcess (SUSPENDED) + NtUnmapViewOfSection + WriteProcessMemory # 3. APC Injection#    - QueueUserAPC targeting alertable threads # 4. Thread Execution Hijacking#    - SuspendThread + SetThreadContext + ResumeThread``` ### Rootkit Detection ```bash# Compare process listsvol -f memory.raw windows.pslist > pslist.txtvol -f memory.raw windows.psscan > psscan.txtdiff pslist.txt psscan.txt  # Hidden processes # Check for DKOM (Direct Kernel Object Manipulation)vol -f memory.raw windows.callbacks # Detect hooked functionsvol -f memory.raw windows.ssdt  # System Service Descriptor Table # Driver analysisvol -f memory.raw windows.driverscanvol -f memory.raw windows.driverirp``` ### Credential Extraction ```bash# Dump hashes (requires hivelist first)vol -f memory.raw windows.hashdump # LSA secretsvol -f memory.raw windows.lsadump # Cached domain credentialsvol -f memory.raw windows.cachedump # Mimikatz-style extraction# Requires specific plugins/tools``` ## YARA Integration ### Writing Memory YARA Rules ```yararule Suspicious_Injection{    meta:        description = "Detects common injection shellcode"     strings:        // Common shellcode patterns        $mz = { 4D 5A }        $shellcode1 = { 55 8B EC 83 EC }  // Function prologue        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // Push hash, call     condition:        $mz at 0 or any of ($shellcode*)} rule Cobalt_Strike_Beacon{    meta:        description = "Detects Cobalt Strike beacon in memory"     strings:        $config = { 00 01 00 01 00 02 }        $sleep = "sleeptime"        $beacon = "%s (admin)" wide     condition:        2 of them}``` ### Scanning Memory ```bash# Scan all process memoryvol -f memory.raw windows.yarascan --yara-rules rules.yar # Scan specific processvol -f memory.raw windows.yarascan --yara-rules rules.yar --pid 1234 # Scan kernel memoryvol -f memory.raw windows.yarascan --yara-rules rules.yar --kernel``` ## String Analysis ### Extracting Strings ```bash# Basic string extractionstrings -a memory.raw > all_strings.txt # Unicode stringsstrings -el memory.raw >> all_strings.txt # Targeted extraction from process dumpvol -f memory.raw windows.memmap --pid 1234 --dumpstrings -a pid.1234.dmp > process_strings.txt # Pattern matchinggrep -E "(https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" all_strings.txt``` ### FLOSS for Obfuscated Strings ```bash# FLOSS extracts obfuscated stringsfloss malware.exe > floss_output.txt # From memory dumpfloss pid.1234.dmp``` ## Best Practices ### Acquisition Best Practices 1. **Minimize footprint**: Use lightweight acquisition tools2. **Document everything**: Record time, tool, and hash of capture3. **Verify integrity**: Hash memory dump immediately after capture4. **Chain of custody**: Maintain proper forensic handling ### Analysis Best Practices 1. **Start broad**: Get overview before deep diving2. **Cross-reference**: Use multiple plugins for same data3. **Timeline correlation**: Correlate memory findings with disk/network4. **Document findings**: Keep detailed notes and screenshots5. **Validate results**: Verify findings through multiple methods ### Common Pitfalls - **Stale data**: Memory is volatile, analyze promptly- **Incomplete dumps**: Verify dump size matches expected RAM- **Symbol issues**: Ensure correct symbol files for OS version- **Smear**: Memory may change during acquisition- **Encryption**: Some data may be encrypted in memory